Lucene search

CVE-2024-34351

🗓️ 14 May 2024 15:42:38Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 20 Media mentions👁 364 Views🌐 WEB

Next.js SSRF vulnerability in Server Actions fixed in version 14.1.

AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 17
OSV	GHSA-FR5H-RQP8-MJ6G Next.js Server-Side Request Forgery in Server Actions	9 May 202421:18	–	osv
OSV	CGA-WPM2-67F8-C286	20 Aug 202404:19	–	osv
OSV	CVE-2024-34351	14 May 202415:38	–	osv
Wolfi	CVE-2024-34351 vulnerabilities	14 May 202415:38	–	wolfi
Cvelist	CVE-2024-34351 Next.js Server-Side Request Forgery in Server Actions	9 May 202416:14	–	cvelist
GithubExploit	Exploit for CVE-2024-34351	13 May 202409:51	–	githubexploit
GithubExploit	Exploit for CVE-2024-34351	27 Aug 202415:10	–	githubexploit
GithubExploit	Exploit for CVE-2024-34351	12 May 202410:49	–	githubexploit
Nuclei	Next.js - Server Side Request Forgery (SSRF)	15 Jul 202408:52	–	nuclei
Chainguard	CVE-2024-34351 vulnerabilities	14 May 202415:38	–	cgr

Vulners

Vulnrichment

Node

vercel next.jsRange13.4.0–14.1.1

[
  {
    "vendor": "vercel",
    "product": "next.js",
    "versions": [
      {
        "version": ">= 13.4.0, < 14.1.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/vercel/next.js/pull/62561
github	www.github.com/vercel/next.js/security/advisories/GHSA-fr5h-rqp8-mj6g
github	www.github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085

Parameter	Position	Path	Description	CWE
Host	header	/	An attacker can control the Host header to redirect requests from the Next.js server to an attacker-controlled server.	CWE-918
Origin	header	/	An attacker can control the Origin header to redirect requests from the Next.js server to an attacker-controlled server.	CWE-918
SSRF	header	/	An attacker can set a custom SSRF header to specify the target for the SSRF attack.	CWE-918

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

14 May 2024 15:38Current

6.4Medium risk

Vulners AI Score6.4

CVSS37.5

EPSS0.81036

SSVC

CWE-918