PT-2025-31048 · Ssrfcheck · Ssrfcheck
Liran Tal
·
Published
2025-07-28
·
Updated
2025-07-28
·
CVE-2025-8267
CVSS v3.1
8.2
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Fix
SSRF
Weakness Enumeration
Related Identifiers
Affected Products
Ssrfcheck
Liran Tal
·
Published
2025-07-28
·
Updated
2025-07-28
·
CVE-2025-8267
8.2
High
| Base vector | Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions:
ssrfcheck versions prior to 1.2.0
Description:
The package is vulnerable to Server-Side Request Forgery (SSRF) due to an incomplete denylist of IP address ranges. The package fails to classify the reserved IP address space 224.0.0.0/4 (Multicast) as invalid, allowing attackers to craft requests targeting these multicast addresses.
Recommendations:
Update to ssrfcheck version 1.2.0 or later.
Fix
SSRF