CVE-2023-27162

openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

• CWE-918
• CWE-918

• https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08Third Party Advisory
• https://github.com/OpenAPITools/openapi-generatorProduct
• https://notes.sjtu.edu.cn/s/2_yki_2XqExploit, Third Party Advisory
• https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08Third Party Advisory
• https://github.com/OpenAPITools/openapi-generatorProduct
• https://notes.sjtu.edu.cn/s/2_yki_2XqExploit, Third Party Advisory
• https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08Third Party Advisory

Published

Mar 31, 2023

Last Modified

Jul 9, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-27151openCRX 5.2.0 was discovered to contain an HTML injection vu…6.1
• CVE-2023-27152DECISO OPNsense 23.1 does not impose rate limits for authent…9.8
• CVE-2023-27159Appwrite up to v1.2.1 was discovered to contain a Server-Sid…7.5
• CVE-2023-2716The Groundhogg plugin for WordPress is vulnerable to unautho…5.4
• CVE-2023-27160forem up to v2022.11.11 was discovered to contain a Server-S…7.2
• CVE-2023-27161Jellyfin up to v10.7.7 was discovered to contain a Server-Si…7.5
• CVE-2023-27163request-baskets up to v1.2.1 was discovered to contain a Ser…6.5
• CVE-2023-27164An arbitrary file upload vulnerability in Halo up to v1.6.1 …4.8
• CVE-2023-27167Suprema BioStar 2 v2.8.16 was discovered to contain a SQL in…6.5
• CVE-2023-27168An arbitrary file upload vulnerability in Xpand IT Write-bac…9.8
• CVE-2023-27169Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in …6.5
• CVE-2023-2717The Groundhogg plugin for WordPress is vulnerable to Cross-S…4.3