~ / search / GHSA-9x7h-ggc3-xg47

GHSA-9x7h-ggc3-xg47

imgproxy is vulnerable to Server-Side Request Forgery

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-30019

Packages

EcosystemPackageAffectedFixed in
Go github.com/imgproxy/imgproxy/v3 < 3.15.0 3.15.0

Details

As written in the advisory (Markdown source, shown as plain text).

imgproxy prior to version 3.15.0 is vulnerable to Server-Side Request Forgery (SSRF) due to a lack of sanitization of the imageURL parameter.

References

External links from the advisory. They lead to third-party sites.