Common Weakness Enumeration

    CWE Definition / CWE-918

    CWE-918: Server-Side Request Forgery (SSRF)

    The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

    Published:17 Feb 2013
    Organization:MITRE
    Modified:30 Apr 2026

    Related Weakness

    CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')

    CWE-610: Externally Controlled Reference to a Resource in Another Sphere