[org.gluu:oxauth-common] Gluu Oxauth before v4.4.1 vulnerable to Server-Side Request Forgery attacks via a crafted request_uri parameter

Gluu Oxauth before v4.4.1 allows attackers to execute blind SSRF (Server-Side Request Forgery) attacks via a crafted request_uri parameter.

References

• https://nvd.nist.gov/vuln/detail/CVE-2022-36663
• https://github.com/GluuFederation/oxAuth/releases/tag/4.4.1
• https://gluu.org/gluu-4-4-1/
• https://github.com/advisories/GHSA-hc94-9v26-gxwv