Threats tagged 'ghsa-85hq-hqhm-3jf2'

Lichess lila before commit 11b4c0fb00f0ffd823246f839627005459c8f05c contains a Server-Side Request Forgery (SSRF) vulnerability in its game export API. The vulnerability arises because the players parameter is passed directly to an internal HTTP client without validation, enabling remote attackers to make the server send HTTP requests to arbitrary URLs. This flaw has a CVSS score of 6.5, indicating a medium severity level. No specific affected versions or patches are provided in the data.