{"id":"CVE-2019-12161","details":"WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168).","modified":"2026-08-27T08:14:56.604963Z","published":"2019-05-17T19:29:00.790Z","references":[{"type":"REPORT","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1550366"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/catchpoint/WebPageTest","events":[{"introduced":"6b183a5e48d3255ae1e86e5c92c255871c3958da"},{"last_affected":"6b183a5e48d3255ae1e86e5c92c255871c3958da"}],"database_specific":{"cpe":"cpe:2.3:a:webpagetest:webpagetest:19.04:*:*:*:*:*:*:*","extracted_events":[{"introduced":"19.04"},{"last_affected":"19.04"}],"source":"CPE_STRING"}}],"versions":["19.04"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12161.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}