CWE · MITRE source
CWE-918Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Last updated: 09 May 2026 03:25 UTC
NIST 800-53 r5 controls that address this weakness (4)AI
| Control | Title | Family | Why it addresses this CWE |
|---|---|---|---|
SI-10 | Information Input Validation | SI | Validates server-side URLs and resource references to block SSRF attempts. |
SI-4 | System Monitoring | SI | Detects server-side request forgery through monitoring of unexpected outbound connections. |
CA-8 | Penetration Testing | CA | Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation. |
SC-7 | Boundary Protection | SC | Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact. |
Top CVEs of this weakness type, ranked by Risk Priority
| CVE | Risk | CVSS | EPSS | Published |
|---|---|---|---|---|
CVE-2021-22986 KEV | 9.6 | 9.8 | 0.9448 | 2021-03-31 |
CVE-2021-21985 KEV | 9.6 | 9.8 | 0.9441 | 2021-05-26 |
CVE-2020-7796 KEV | 9.5 | 9.8 | 0.9269 | 2020-02-18 |
CVE-2021-26855 KEV | 9.5 | 9.1 | 0.9435 | 2021-03-03 |
CVE-2021-34473 KEV | 9.5 | 9.1 | 0.9423 | 2021-07-14 |
CVE-2021-40438 KEV | 9.5 | 9.0 | 0.9443 | 2021-09-16 |
CVE-2022-41040 KEV | 9.4 | 8.8 | 0.9415 | 2022-10-03 |
CVE-2024-21893 KEV | 9.3 | 8.2 | 0.9432 | 2024-01-31 |
CVE-2021-21975 KEV | 9.2 | 7.5 | 0.9442 | 2021-03-31 |
CVE-2019-9621 KEV | 9.1 | 7.5 | 0.9411 | 2019-04-30 |
CVE-2021-21311 KEV | 9.1 | 7.2 | 0.9418 | 2021-02-11 |
CVE-2021-22054 KEV | 9.1 | 7.5 | 0.9384 | 2021-12-17 |
CVE-2021-21973 KEV | 8.5 | 5.3 | 0.9039 | 2021-02-24 |
CVE-2016-3718 KEV | 7.8 | 5.5 | 0.7882 | 2016-05-05 |
CVE-2019-18394 | 7.6 | 9.8 | 0.9388 | 2019-10-24 |
CVE-2021-27905 | 7.6 | 9.8 | 0.9390 | 2021-04-13 |
CVE-2021-33690 | 7.6 | 9.9 | 0.9326 | 2021-09-15 |
CVE-2022-1386 | 7.6 | 9.8 | 0.9361 | 2022-05-16 |
CVE-2023-51467 | 7.6 | 9.8 | 0.9400 | 2023-12-26 |
CVE-2020-26948 | 7.5 | 9.8 | 0.9173 | 2020-10-10 |
CVE-2021-27670 | 7.5 | 9.8 | 0.9284 | 2021-02-25 |
CVE-2021-22175 KEV | 7.5 | 6.8 | 0.6974 | 2021-06-11 |
CVE-2021-32682 | 7.5 | 9.8 | 0.9277 | 2021-06-14 |
CVE-2023-43654 | 7.5 | 10.0 | 0.9165 | 2023-09-28 |
CVE-2023-48022 | 7.5 | 9.8 | 0.9219 | 2023-11-28 |