CVE-2023-27163

MediumPublished

request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows...

Published: Mar 31, 2023
Updated: Jul 9, 2026
Assigning CNA: mitre
Evidence observed: Aug 7, 2026

Primary CVSS

6.5/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS probability estimate

6.6%

Low · next 30 days

Percentile: 93.6%
Model date: Sep 21, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

Sources

CVE-2023-27163-labPoC
Docker-based lab reproducing CVE-2023-27163 SSRF in Request-Baskets, with exploitation verification, detection script, and network-isolation remediation.
CVE-2023-27163Exploit
Proof-of-concept exploit for CVE-2023-27163: Server-Side Request Forgery (SSRF) in Request-Baskets v1.2.1 via crafted API requests to access internal network resources.
CVE-2023-27163PoC
Proof-of-concept exploit for CVE-2023-27163, a Server-Side Request Forgery (SSRF) vulnerability in request-baskets up to v1.2.1. Includes automated reverse shell generation and file exposure.

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.