CVE-2024-52588 Strapi allows Server-Side Request Forgery in Webhook function

Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to the application fetching itself, resulting in a server side request forgery SSRF. This issue has been patched in version 4.25.2...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +83 more potentially affected by CVE-2024-52588 via @strapi/admin (>=4.0.0, <=4.25.1)

@strapi/admin NPM version =4.0.0, =4.12.2, =1.0.0, =1.3.0, =1.3.4, =1.2.1, =4.2.0, =4.2.1 - @cowprotocol/cms 0.1.0-rc.5 and more Source cves: CVE-2024-52588 Source advisory: OSV:GHSA-V8WJ-F5C7-PVXF...

CVE-2024-52588

creationtimestamp| type| source ---|---|--- 2025-05-27 14:27:33+00:00| published-proof-of-concept| https://github.com/strapi/strapi/security/advisories/GHSA-v8wj-f5c7-pvxf 2025-05-29 10:13:44+00:00| seen|...