# CVE-2023-27163

request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

- Page: https://www.vulneraibility.com/cve/CVE-2023-27163
- CVSS: 6.5
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 6.54% (percentile 93.9)
- Unvetted proof-of-concept code on GitHub: 24 GitHub proofs of concept · 1 Nuclei template (first 2023-07-11)
- CISA SSVC: exploitation poc, automatable no, technical impact total (assessed 2025-02-18)
- Weakness: CWE-918
- Published: 2023-03-31

## Affected

- rbaskets:request_baskets

## References

- [other] https://notes.sjtu.edu.cn/s/MUUhEymt7
- [other] https://github.com/darklynx/request-baskets
- [other] https://gist.github.com/b33t1e/3079c10c88cad379fb166c389ce3b7b3
- [other] http://packetstormsecurity.com/files/174129/Maltrail-0.53-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/174128/Request-Baskets-1.2.1-Server-Side-Request-Forgery.html

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.