CVE-2023-27163
MEDIUM 6.5EPSS 6.6%
request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
- CVSS v3.1
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - CVSS v3.1
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - CVSS v3.1
- 6.5 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N - EPSS
- 6.59% chance of exploitation in the next 30 days, 93th percentile
- Nuclei
- medium · CWE-918
- Published
- 2023-03-31
- Updated
- 2026-07-09
Proof-of-concept exploits (30)
- https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3
- 0xFTW/CVE-2023-271630★ · 2023-08-13
- Hamibubu/CVE-2023-271630★ · 2023-09-21
- HusenjanDev/CVE-2023-27163-AND-Mailtrail-v0.532★ · 2023-08-05
- J0ey17/Exploit_CVE-2023-271631★ · 2025-06-03
- Khalidhaimur/exploit-request-baskets-1.2.11★ · 2025-04-20
- MasterCode112/CVE-2023-271632★ · 2024-01-10
- ThickCoco/CVE-2023-27163-POC1★ · 2023-07-26
- bl4ckarch/ssrf_to_rce_sau1★ · 2025-06-22
- btar1gan/exploit_CVE-2023-271630★ · 2024-09-22
- cowsecurity/CVE-2023-271630★ · 2023-08-13
- davuXVI/CVE-2023-271631★ · 2023-07-26
- entr0pie/CVE-2023-2716331★ · 2023-08-09
- hadrian3689/requests-baskets_1.2.10★ · 2023-07-25
- infcodev/pentesting_scripts0★ · 2026-01-03
- josephberger/CVE-2023-271630★ · 2023-08-29
- lukehebe/CVE-2023-271632★ · 2025-04-18
- madhavmehndiratta/CVE-2023-271630★ · 2024-01-06
- overgrowncarrot1/CVE-2023-271630★ · 2023-07-20
- rvizx/CVE-2023-271632★ · 2023-08-09
- samh4cks/CVE-2023-27163-InternalProber5★ · 2023-08-28
- seanrdev/cve-2023-271634★ · 2023-07-22
- theopaid/CVE-2023-27163-Request-Baskets-Local-Ports-Bruteforcer1★ · 2025-06-08
- thomas-osgood/CVE-2023-271632★ · 2023-08-14
- Jeanback1/CVE-2023-27163-exploit
- lukehebe/CVE-2023-27163-POC
- rvzsec/CVE-2023-27163
- thealchimist86/CVE-2023-27163---Maltrail-0.53---RCE
- thealchimist86/CVE-2023-27163---SSRF-Baskets-Requests
- tombstoneghost/htb-sau-exploit-chain