PT-2023-30174
CVE-2023-46730
·
تاريخ النشر
2023-11-07
·
تاريخ التحديث
2023-11-14
الوصف من
CVSS 3.1
7.4
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions
Group-Office versions prior to 6.8.15
Group-Office versions prior to 6.7.54
Group-Office versions prior to 6.6.177
Description
The issue is related to a full Server-Side Request Forgery (SSRF) vulnerability in the "/api/upload.php" endpoint. This endpoint does not filter URLs, allowing a malicious user to cause the server to make resource requests to untrusted domains. Protocols like "file://" can also be used to access the server disk. The request result can then be retrieved using "/api/download.php".
Recommendations
For versions prior to 6.8.15, upgrade to version 6.8.15 or later.
For versions prior to 6.7.54, upgrade to version 6.7.54 or later.
For versions prior to 6.6.177, upgrade to version 6.6.177 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾