Skip to content
Fencer Vulns
medium 6.1

CVE-2023-28155 json

Server-Side Request Forgery in Request

published 2023-03-16 3 y ago modified 2026-09-10 1 mo ago also GHSA-p8p7-x288-28g6 , EUVD-2023-1068

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Patch / fix

  • npm @cypress/request 3.0.0
  • reaper CBL-Mariner 2.0 3.1.1-5

azure linux advisories AZL-25664

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-28155 updated cvss 6.1

request: bypass of SSRF mitigations when following a cross-protocol redirect

  • Red Hat Ceph Storage 7 arrow, pybind, thrift Red Hat Ceph Storage 8 arrow, pybind, thrift, thrift-qt, perl-thrift, thrift-glib, +1 more
    affected: no fix available
  • Red Hat Ceph Storage 7.1 rhceph/rhceph-7-rhel9 1791452477
    fixed: vendor fix RHSA-2026:83548
  • Red Hat Ceph Storage 8.1 rhceph/rhceph-8-rhel9 1787550654
    fixed: vendor fix RHSA-2026:62115
  • Red Hat Cryostat 4 cryostat/cryostat-openshift-console-plugin-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/kibana6-rhel8 Red Hat OpenShift Serverless openshift-serverless-1/kn-backstage-plugins-eventmesh-rhel8 Red Hat build of Apicurio Registry 2 io.apicurio-apicurio-registry Red Hat Ceph Storage 7.1 rhceph/grafana-rhel9 1791450715, rhceph/keepalived-rhel9 1791453133, rhceph/snmp-notifier-rhel9 1791450035, rhceph/rhceph-haproxy-rhel9 1791452229, rhceph/rhceph-promtail-rhel9 1791451373 Red Hat Ceph Storage 8.1 rhceph/grafana-rhel9 1787305054, rhceph/keepalived-rhel9 1787303659, rhceph/oauth2-proxy-rhel9 1787304106, rhceph/snmp-notifier-rhel9 1787303640, rhceph/rhceph-haproxy-rhel9 1787304199, rhceph/rhceph-promtail-rhel9 1787304137
    +13 more products
    Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/rhdh-rhel9-operator Red Hat Enterprise Linux 7 firefox, thunderbird Red Hat Enterprise Linux 8 pcs, grafana, mozjs60, pcs-snmp, grafana-pcp, grafana-loki, +12 more Red Hat Enterprise Linux 9 pcs, grafana, pcs-snmp, grafana-selinux Red Hat Fuse 7 io.hawt-project, io.apicurio-apicurito, io.hawt-hawtio-online, io.syndesis-syndesis-parent Red Hat JBoss Enterprise Application Platform 7 io.hawt-project, org.jboss.hal-hal-parent Red Hat JBoss Enterprise Application Platform 8 io.hawt-project Red Hat JBoss Enterprise Application Platform Expansion Pack io.hawt-project Red Hat OpenShift AI (RHOAI) rhoai/odh-rhel8-operator, rhods/odh-rhel8-operator, rhoai/odh-dashboard-rhel8, rhoai/odh-dashboard-rhel9, rhods/odh-dashboard-rhel8, rhoai/odh-notebook-controller-rhel8, +3 more Red Hat Openshift Data Foundation 4 odf4/mcg-core-rhel9 Red Hat OpenShift Dev Spaces devspaces/code-rhel8, devspaces/code-rhel9, devspaces/traefik-rhel9, devspaces/dashboard-rhel8, devspaces/dashboard-rhel9, devspaces/configbump-rhel9, +4 more Red Hat OpenShift GitOps openshift-gitops-1/dex-rhel8, openshift-gitops-1/argocd-rhel8, openshift-gitops-1/argocd-rhel9, openshift-gitops-1/gitops-rhel8, openshift-gitops-1/must-gather-rhel8, openshift-gitops-1/argocd-agent-rhel8, +5 more Red Hat Process Automation 7 org.uberfire-uberfire-parent, org.kie.workbench-kie-wb-common, org.kie-process-migration-service
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.72% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/request/request/issues/3442 referenced PoC, tagged "exploit" by a source, unverified
  • doyensec.com https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
npm request
<=2.88.2
 no fix listed
npm @cypress/request
<3.0.0
3.0.0

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.