{"api_version":"1","generated_at":"2026-07-23T12:47:28+00:00","cve":"CVE-2020-28463","urls":{"html":"https://cve.report/CVE-2020-28463","api":"https://cve.report/api/cve/CVE-2020-28463.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-28463","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-28463"},"summary":{"title":"CVE-2020-28463","description":"All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src=\"http://127.0.0.1:5000\" valign=\"top\"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF","state":"PUBLIC","assigner":"report@snyk.io","published_at":"2021-02-18 16:15:00","updated_at":"2023-11-07 03:21:00"},"problem_types":["CWE-918"],"metrics":[],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMUJA5GZTPQ5WRYUCCK2GEZM4W43N7HH/","name":"FEDORA-2021-13cdc0ab0e","refsource":"","tags":[],"title":"[SECURITY] Fedora 34 Update: python-reportlab-3.6.2-1.fc34 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html","name":"[debian-lts-announce] 20230929 [SECURITY] [DLA 3590-1] python-reportlab security update","refsource":"MLIST","tags":[],"title":"[SECURITY] [DLA 3590-1] python-reportlab security update","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145","name":"N/A","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"Server-side Request Forgery (SSRF) in reportlab | Snyk","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZQSFCID67K6BTC655EQY6MNOF35QI44/","name":"FEDORA-2021-04bfae8300","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 35 Update: python-reportlab-3.6.2-1.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMUJA5GZTPQ5WRYUCCK2GEZM4W43N7HH/","name":"FEDORA-2021-13cdc0ab0e","refsource":"FEDORA","tags":[],"title":"[SECURITY] Fedora 34 Update: python-reportlab-3.6.2-1.fc34 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZQSFCID67K6BTC655EQY6MNOF35QI44/","name":"FEDORA-2021-04bfae8300","refsource":"","tags":[],"title":"[SECURITY] Fedora 35 Update: python-reportlab-3.6.2-1.fc35 - package-announce - Fedora Mailing-Lists","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.reportlab.com/docs/reportlab-userguide.pdf","name":"N/A","refsource":"CONFIRM","tags":["Product","Vendor Advisory"],"title":"","mime":"application/pdf","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-28463","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-28463","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"LEGACY","value":"Karan Bamal","lang":""}],"nvd_cpes":[{"cve_year":"2020","cve_id":"28463","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"34","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28463","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"fedoraproject","cpe5":"fedora","cpe6":"35","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28463","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"reportlab","cpe5":"reportlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"28463","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"reportlab","cpe5":"reportlab","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-28463","qid":"282012","title":"Fedora Security Update for python (FEDORA-2021-13cdc0ab0e)"},{"cve":"CVE-2020-28463","qid":"6000091","title":"Debian Security Update for python-reportlab (DLA 3590-1)"},{"cve":"CVE-2020-28463","qid":"750945","title":"OpenSUSE Security Update for python-reportlab (openSUSE-SU-2021:2641-1)"},{"cve":"CVE-2020-28463","qid":"750958","title":"OpenSUSE Security Update for python-reportlab (openSUSE-SU-2021:1147-1)"},{"cve":"CVE-2020-28463","qid":"980087","title":"Python (pip) Security Update for reportlab (GHSA-mpvw-25mg-59vx)"}]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ASSIGNER":"report@snyk.io","DATE_PUBLIC":"2021-02-18T15:59:17.672425Z","ID":"CVE-2020-28463","STATE":"PUBLIC","TITLE":"Server-side Request Forgery (SSRF)"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"reportlab","version":{"version_data":[{"version_affected":">=","version_value":"0"}]}}]},"vendor_name":"n/a"}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Server-side Request Forgery (SSRF)"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145","name":"https://snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145"},{"refsource":"MISC","url":"https://www.reportlab.com/docs/reportlab-userguide.pdf","name":"https://www.reportlab.com/docs/reportlab-userguide.pdf"},{"refsource":"FEDORA","name":"FEDORA-2021-13cdc0ab0e","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HMUJA5GZTPQ5WRYUCCK2GEZM4W43N7HH/"},{"refsource":"FEDORA","name":"FEDORA-2021-04bfae8300","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YZQSFCID67K6BTC655EQY6MNOF35QI44/"},{"refsource":"MLIST","name":"[debian-lts-announce] 20230929 [SECURITY] [DLA 3590-1] python-reportlab security update","url":"https://lists.debian.org/debian-lts-announce/2023/09/msg00037.html"}]},"description":{"description_data":[{"lang":"eng","value":"All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src=\"http://127.0.0.1:5000\" valign=\"top\"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF"}]},"impact":{"cvss":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},"credit":[{"lang":"eng","value":"Karan Bamal"}]},"nvd":{"publishedDate":"2021-02-18 16:15:00","lastModifiedDate":"2023-11-07 03:21:00","problem_types":["CWE-918"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":3.6},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:reportlab:reportlab:*:*:*:*:*:*:*:*","cpe_name":[]}]},{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"28463","Ordinal":"190950","Title":"CVE-2020-28463","CVE":"CVE-2020-28463","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"28463","Ordinal":"1","NoteData":"All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src=\"http://127.0.0.1:5000\" valign=\"top\"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF","Type":"Description","Title":null},{"CveYear":"2020","CveId":"28463","Ordinal":"2","NoteData":"2021-02-18","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"28463","Ordinal":"3","NoteData":"2021-10-29","Type":"Other","Title":"Modified"}]}}}