critical9.8
CVE-2022-36663
Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter
Impact
Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.gluu:oxauth-common | < 4.4.1 | 4.4.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gluu | Oxauth | before 4.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/GluuFederation/oxAuth/releases/tag/4.4.1
- https://gluu.org/gluu-4-4-1/
- https://github.com/advisories/GHSA-hc94-9v26-gxwv
- https://nvd.nist.gov/vuln/detail/CVE-2022-36663
- https://github.com/GluuFederation/oxAuth/commit/58c4ac9bbf2addf4b419bf155de99db57a202f5c