{"id":"CVE-2020-1925","aliases":["GHSA-v4qh-6367-4cx2"],"url":"https://o3.security/vulnerability/CVE-2020-1925","summary":"Server-Side Request Forgery (SSRF) in Apache Olingo","details":"Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.","published":"2020-01-09T19:15:10.807Z","modified":"2026-07-08T20:30:46.399120Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Maven","name":"org.apache.olingo:odata-client-core","fixedVersion":"4.7.1"}],"fix":null,"references":[{"type":"FIX","url":"https://mail-archives.apache.org/mod_mbox/olingo-user/202001.mbox/%3CCAGSZ4d6HwpF2woOrZJg_d0SkHytXJaCtAWXa3ZtBn33WG0YFvw%40mail.gmail.com%3E"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T20:30:46.399120Z"}}