Threats tagged 'ghsa-7wm7-v445-mpw3'

SurrealDB versions from 3.1.0 up to but not including 3.3.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows database Owners to bypass port-specific deny-net rules by using JSON Web Key Set (JWKS) URLs that omit the explicit port number 80 or 443. As a result, blind GET requests can be made to internal services that are otherwise explicitly denied by network rules.