Server-Side Request Forgery (SSRF)

2024-05-2707:16:27

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

server-side request forgery

input validation

cover/show route

remote attackers

cross-site scripting

proxying

arbitrary urls

http servers

AI Score

6.4

Confidence

High

JSON

vufind/vufind is vulnerable to Server-Side Request Forgery (SSRF). The vulnerability is due to improper input validation in the /Cover/Show route, allowing remote attackers to access internal HTTP servers and execute Cross-Site Scripting (XSS) attacks by proxying arbitrary URLs via the proxy GET parameter.