Weakness · CWE-918
Server-Side Request Forgery (SSRF)
The server can be made to fetch a URL of the attacker's choosing, often internal services or cloud metadata.
Official CWE name. Full definition on cwe.mitre.org
In the news
CVEs with this weakness that SecurityTabs has covered, newest first.
- CVE-2026-96652Plex Media Server SSRFMedium 5.3KEV
- CVE-2026-20362Cisco Finesse Server-Side Request Forgery VulnerabilityHigh 7.2
- CVE-2026-101022Grid Protection Alliance openPDC and openHistorian Server-Side Request Forgery (SSRF)Medium 5.3
- CVE-2026-107362Server-Side Request Forgery in MalcolmHigh 7.1
- CVE-2026-96655Plex Media Server arbitrary-host SSRFMedium 5.3KEV
How attackers exploit it
Typical ATT&CK techniques for this class of weakness across CISA's Known Exploited Vulnerabilities (CTID mapping).
How it's exploited
What the attacker gets
Controls that stop it
NIST SP 800-53 controls that mitigate the most of those techniques.
- SI-4System MonitoringSystem and Information Integrity · mitigates 9 techniques
- AC-3Access EnforcementAccess Control · mitigates 7 techniques
- AC-6Least PrivilegeAccess Control · mitigates 7 techniques
- CA-7Continuous MonitoringSecurity Assessment and Authorization · mitigates 7 techniques
- CM-6Configuration SettingsConfiguration Management · mitigates 7 techniques
- AC-2Account ManagementAccess Control · mitigates 6 techniques
- RA-5Vulnerability Monitoring and ScanningRisk Assessment · mitigates 6 techniques
- SI-3Malicious Code ProtectionSystem and Information Integrity · mitigates 6 techniques
- CM-2Baseline ConfigurationConfiguration Management · mitigates 5 techniques
- CM-7Least FunctionalityConfiguration Management · mitigates 5 techniques
Weaknesses from each CVE's CVE Record (CWE, © MITRE). Techniques: MITRE ATT&CK®. Technique ↔ control and CVE ↔ technique links: Center for Threat-Informed Defense Mappings Explorer (NIST SP 800-53 rev5; CISA KEV). Plain-language explainers are SecurityTabs editorial.