CVE-2020-15879 – Bitwarden Server 1.35.1 allows SSRF because it does not consider certain

4 years ago

Bitwarden Server 1.35.1 allows SSRF because it does not consider certain IPv6 addresses (ones beginning with fc, fd, fe, or ff, and the :: address) and certain IPv4 addresses (0.0.0.0/8, 127.0.0.0/8, and 169.254.0.0/16).

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15879

Reference (s):

https://github.com/bitwarden/server/pull/827