CVE-2022-38580

A vulnerability in Zalando Skipper version 0.13.236 allows Server-Side Request Forgery (SSRF). An attacker can send a malicious request that is executed by the server, potentially leading to unauthorized access to internal resources.

The risk involves the server being used as a proxy to attack the organization's internal network, which could result in data leakage, privilege escalation, or further attacks on internal systems.

It is recommended to immediately update Zalando Skipper to the latest version that includes a fix for this vulnerability. Additionally, restrict access to internal resources through appropriate firewall rules and request validation.