Threats tagged 'ghsa-5j62-5j8p-jpqh'

MediaFlow Proxy versions up to and including 2.4.9 contain a server-side request forgery (SSRF) vulnerability in the /proxy routes. This vulnerability arises from missing and incomplete validation of the destination URL specified in the 'd' query parameter. An unauthenticated remote attacker can exploit this flaw to make the proxy server send requests to arbitrary internal URLs, including loopback addresses and cloud metadata endpoints, potentially reading full responses from these internal resources.