Experts warn of a coordinated surge in the exploitation attempts of SSRF vulnerabilities
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-0929 | DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class | 7.5 | 13% | ||
| CVE-2020-7796 | Unauthenticated SSRF in Synacor Zimbra Collaboration Suite (CVE-2020-7796) | 9.8 | 94% | KEV | KEV |
| CVE-2021-21973 | SSRF in VMware vCenter Server and Cloud Foundation (vSphere Client HTML5) | 5.3 | 88% | KEV | KEV |
| CVE-2021-22054 | Unauthenticated SSRF in VMware (Omnissa) Workspace ONE UEM Console | 7.5 | 100% | KEV | KEV |
| CVE-2021-22175 | Unauthenticated SSRF in GitLab via Internal-Network Webhook Requests (CVE-2021-22175) | 9.8 | 53% | KEVPoC | KEV |
| CVE-2021-22214 | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting… | 8.6 | 28% | ||
| CVE-2021-39935 | Server-Side Request Forgery in GitLab Community and Enterprise Editions via CI Lint API | 7.5 | 36% | KEV | KEV |
| CVE-2023-5830 | A vulnerability classified as critical has been found in ColumbiaSoft Document Locator | 9.8 | 61% | ||
| CVE-2024-21893 | SSRF in Ivanti Connect Secure, Policy Secure, and Neurons SAML Component | 8.2 | 100% | KEVRansomware | KEV |
| CVE-2024-6587 | SSRF in LiteLLM Leaks OpenAI API Keys via api_base Parameter | 7.5 | 34% | PoC |
From the original article
2 min read at securityaffairs.com
Researchers warn of a “coordinated surge” in the exploitation attempts of SSRF vulnerabilities in multiple platforms. Threat intelligence firm GreyNoise observed Grafana path traversal exploitation attempts before the Server-Side Request Forgery (SSRF) surge on March 9, suggesting the attackers may be leveraging Grafana as an initial entry point for deeper exploitation.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.