Threats tagged 'ghsa-3x3x-8ffg-ghcv'

A Server-Side Request Forgery (SSRF) vulnerability exists in Google mcp-toolbox versions 0.3.0 through 1.4.0. The vulnerability arises because the HTTP client used by the toolbox does not enforce restrictive redirect policies or validate target IPs, allowing crafted requests to cause unauthorized internal or external requests. This can lead to information disclosure or unauthorized interactions with internal systems. The vulnerability has a CVSS score of 6.1, indicating a high severity level.