CVE-2023-30019

Description

imgproxy is vulnerable to Server-Side Request Forgery in github.com/imgproxy/imgproxy

How to fix CVE-2023-30019

To remediate CVE-2023-30019, upgrade the affected package to a fixed version below.

• Go/github.com/imgproxy/imgproxy—no fix listed
• Go/github.com/imgproxy/imgproxy/v2—no fix listed
• —upgrade to 3.15.0 or later
• —upgrade to 3.15.0 or later

Is CVE-2023-30019 being exploited?

Likely — EPSS is 70.6%, placing CVE-2023-30019 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (4)

• from 0
• from 0
• from 0, < 3.15.0
• from 0, < 3.15.0

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-9x7h-ggc3-xg47
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2023-30019
• PATCHgithub.com/imgproxy/imgproxy
• WEBbreakandpray.com/cve-2023-30019-ssrf-in-imgproxy