CVE-2022-38580
CVE-2022-38580
Vexday Risk Score
53Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
Exploit maturity
Proof of concept
Public proof of concept exists, but not yet automated.
CVSS 9.8EPSS 10.6%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
24 Oct 2022Published on NVD
28 Mar 2023Public PoC
Weaponization speed
155 daysto first PoC
Recommendation: Plan a near-term fix — a public PoC already exists.
Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/apublic PoCs found — 2
cve_referencepacketstormsecurity.com/files/171546/X-Skipper-Proxy-0.13.237-Server-Side-Request-Forgery.htmlunverifiedexploitdbwww.exploit-db.com/exploits/51111unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.