Description

The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirect. The webhook dispatcher automatically follows HTTP redirects without performing post-redirect IP resolution or RFC1918/link-local boundary checks. Non-2xx responses from target endpoints are captured and reflected directly back to the caller.

Related CPE's

Could not find any relations

References

Weaknesses

Could not find any weaknesses

CVSS impact metrics

Could not find any metrics

Information