CVE-2023-30019: 
NixOS vulnerability analysis and mitigation

imgproxy version 3.14.0 and earlier contains a Server-Side Request Forgery (SSRF) vulnerability due to insufficient sanitization of the imageURL parameter. The vulnerability was disclosed on May 8, 2023, affecting the imgproxy application, which is a standalone server for resizing and converting remote images (NVD, CVE).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) with a CVSS v3.1 base score of 5.3 (Medium). The attack vector is network-based, requires no privileges or user interaction, and has a low attack complexity. The vulnerability stems from inadequate validation of the imageURL parameter, which could allow attackers to make unauthorized requests through the server (NVD, FortiGuard).

If exploited, this SSRF vulnerability could allow attackers to access and read data from internal services, potentially exposing sensitive information. The vulnerability primarily affects the confidentiality of the system, with no direct impact on integrity or availability (NVD).

The vulnerability has been fixed in imgproxy version 3.15.0. Users are advised to upgrade to this version or later to mitigate the risk. Organizations using affected versions should upgrade their imgproxy installations as soon as possible (FortiGuard).