CVE-2023-46730

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.15 Group-Office versions prior to 6.7.54 Group-Office versions prior to 6.6.177

Description The issue is related to a full Server-Side Request Forgery (SSRF) vulnerability in the "/api/upload.php" endpoint. This endpoint does not filter URLs, allowing a malicious user to cause the server to make resource requests to untrusted domains. Protocols like "file://" can also be used to access the server disk. The request result can then be retrieved using "/api/download.php".

Recommendations For versions prior to 6.8.15, upgrade to version 6.8.15 or later. For versions prior to 6.7.54, upgrade to version 6.7.54 or later. For versions prior to 6.6.177, upgrade to version 6.6.177 or later.