GitHub Advisoryadvisory · Go

GHSA-58g2-vgpg-335q request-baskets vulnerable to Server-Side Request Forgery

MEDIUM Published 2023-03-31 Modified 2023-04-07 Official page ↗
Aliases
CVE-2023-27163
Ecosystem
Go
Packages
github.com/darklynx/request-baskets
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-918
Reviewed
2023-03-31

Affected packages

• Go github.com/darklynx/request-baskets: <= 1.2.1 (no fix yet)

Description

request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

Related

Alias · CVE (1)

  • CVE-2023-27163 request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References