CVE-2023-27162

CriticalCVSS 9.1

Published: 31/03/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.94%

57th percentile - higher than 57% of all known CVEs

Summary

A Server-Side Request Forgery (SSRF) vulnerability was discovered in openapi-generator up to version 6.4.0 in the /api/gen/clients/{language} component. It allows attackers to access network resources and sensitive information via a crafted API request.

Risk Assessment

Attackers can exploit this vulnerability to scan internal networks, access protected services, or steal sensitive data, potentially leading to security breaches and loss of confidentiality.

Recommendation

Immediately update openapi-generator to a version newer than 6.4.0 where the vulnerability is patched. If an update is not possible, restrict access to the /api/gen/clients/{language} endpoint to trusted IP addresses only.

Original NVD description (English source)

openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.