{"id":"CVE-2019-12161","details":"WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses (such as 0300.0250 as a replacement for 192.168).","modified":"2026-04-10T04:14:26.249822Z","published":"2019-05-17T19:29:00.790Z","references":[{"type":"REPORT","url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1550366"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/wpo-foundation/webpagetest","events":[{"introduced":"0"},{"last_affected":"6b183a5e48d3255ae1e86e5c92c255871c3958da"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"19.04"}]}}],"versions":["18.08","18.09","18.10","19.04","2.13","WebPageTest-17.08","WebPageTest-17.12","WebPageTest-2.16","WebPageTest-2.19","WebPageTest-3.0","WebPagetest-2.12","WebPagetest-2.14","WebPagetest-2.15","stable"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-12161.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}