Lucene search
Veracode Vulnerability DatabaseVERACODE:37685HistoryOct 26, 2022 - 2:04 a.m.
Server-side Request Forgery (SSRF)
2022-10-2602:04:05
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
4
zalando skipper
ssrf vulnerability
proxy header
0.026 Low
EPSS
Percentile
90.4%
github.com/zalando/skipper is vulnerable to server-side request forgery. The vulnerability exists because proxy.go does not properly pass URLs via the request context, allowing an attacker to redirect to the malicious URLs through the X-Skipper-Proxy header.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/zalando/skipper | le | v0.13.236 | |
| github.com/zalando/skipper | le | v0.13.236 |
References
packetstormsecurity.com/files/171546/X-Skipper-Proxy-0.13.237-Server-Side-Request-Forgery.html
skipper.com
zalando.com
gist.github.com/Fadavvi/9fffcfa4aaa9e25b77cfe7b3044b2857#file-cve-2022-38580
github.com/zalando/skipper/commit/842634347da8fe77e396f66edea79d329fd72130
github.com/zalando/skipper/pull/2058
pastebin.com/dXxpgPAK
Related
packetstorm
packetstorm
X-Skipper-Proxy 0.13.237 Server-Side Request Forgery
2023-03-28 00:00:00
nvd
nvd
CVE-2022-38580
2022-10-25 17:15:55
github
github
Skipper vulnerable to SSRF via X-Skipper-Proxy
2022-10-25 20:22:29
cve
cve
CVE-2022-38580
2022-10-25 17:15:55
osv
osv
CVE-2022-38580
2022-10-25 17:15:55
Server-side request forger via X-Skipper-Proxy in github.com/zalando/skipper
2022-11-02 23:44:35
Skipper vulnerable to SSRF via X-Skipper-Proxy
2022-10-25 20:22:29
cvelist
cvelist
CVE-2022-38580
2022-10-24 00:00:00
prion
prion
Server side request forgery (ssrf)
2022-10-25 17:15:00
zdt
zdt
X-Skipper-Proxy v0.13.237 - Server Side Request Forgery Vulnerability
2023-03-28 00:00:00
exploitdb
exploitdb
X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)
2023-03-28 00:00:00