{"id":"CVE-2020-1925","details":"Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.","aliases":["GHSA-v4qh-6367-4cx2"],"modified":"2026-03-13T00:33:32.464646Z","published":"2020-01-09T19:15:10.807Z","references":[{"type":"FIX","url":"https://mail-archives.apache.org/mod_mbox/olingo-user/202001.mbox/%3CCAGSZ4d6HwpF2woOrZJg_d0SkHytXJaCtAWXa3ZtBn33WG0YFvw%40mail.gmail.com%3E"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/apache/olingo-odata4","events":[{"introduced":"ca40833b20e6cae9869f556f93095c0d5fc6d059"},{"last_affected":"531e5bb8eed80ec9459bff25002dd4f29a50683d"}],"database_specific":{"versions":[{"introduced":"4.0.0"},{"last_affected":"4.7.0"}]}}],"versions":["4.0.0","4.1.0","4.1.0-RC01","4.2.0","4.2.0-RC01","4.3.0","4.3.0-RC01","4.3.0-beta","4.4.0","4.5.0","4.6.0","4.6.0-RC01","4.7.0","4.7.0-RC01"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-1925.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}