Server-Side Request Forgery in groupoffice
CVE-2023-46730
7.4HIGH
What is CVE-2023-46730?
Group-Office, a popular CRM and groupware solution, has a vulnerability in the /api/upload.php endpoint that allows Server-Side Request Forgery (SSRF). This flaw enables malicious users to exploit the system and make requests to untrusted domains without proper validation of URLs, potentially leading to unauthorized access to sensitive information. Additionally, the exploit can manipulate file protocols to access server disks. To mitigate risks, users are strongly advised to upgrade to versions 6.8.15, 6.7.54, or 6.6.177 as there are no available workarounds.
Affected Version(s)
groupoffice >= 6.3.0, < 6.6.177 < 6.3.0, 6.6.177
groupoffice >= 6.7.0, < 6.7.54 < 6.7.0, 6.7.54
groupoffice >= 6.8.0, < 6.8.15 < 6.8.0, 6.8.15