x/vulndb: potential Go vuln in github.com/OpenAPITools/openapi-generator: CVE-2023-27162

[GoVulnBot]

CVE-2023-27162 references github.com/OpenAPITools/openapi-generator, which may be a Go module.

Description:
openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-27162
• JSON: https://github.com/CVEProject/cvelist/tree/dd4b92d8b6842dfe62779b3985c9b8fbffb28648/2023/27xxx/CVE-2023-27162.json
• web: http://openapi-generator.com
• web: https://github.com/OpenAPITools/openapi-generator
• web: https://notes.sjtu.edu.cn/s/2_yki_2Xq
• web: https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08
• Imported by: https://pkg.go.dev/github.com/OpenAPITools/openapi-generator?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/OpenAPITools/openapi-generator
    packages:
      - package: n/a
description: |
    openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. This vulnerability allows attackers to access network resources and sensitive information via a crafted API request.
cves:
  - CVE-2023-27162
references:
  - web: http://openapi-generator.com
  - web: https://github.com/OpenAPITools/openapi-generator
  - web: https://notes.sjtu.edu.cn/s/2_yki_2Xq
  - web: https://gist.github.com/b33t1e/6121210ebd9efd4f693c73b830d8ab08

[gopherbot]

Change https://go.dev/cl/482836 mentions this issue: data/excluded: batch add GO-2023-1706, GO-2023-1689, GO-2023-1688, GO-2023-1686