EUVD-2026-72807
GHSA-wpfp-j2f8-c6vj
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Web API endpoint is network-reachable (AV:N); description requires authenticated administrator (PR:H); impact is confidentiality-only via internal network reconnaissance (C:H/I:N/A:N).
Primary rating from Vendor (certcc).
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.
AnalysisAI
Server-Side Request Forgery in ONLYOFFICE ownCloud Integration Plugin version 9.12 enables an authenticated administrator to redirect outbound HTTP requests from the ownCloud server to arbitrary internal destinations by supplying a malicious Document Server URL to the /apps/onlyoffice/ajax/settings/address endpoint. Successful exploitation allows internal network reconnaissance and TCP port scanning through differential server response timing and content. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated administrator access to the ownCloud instance - the vulnerability is triggered through the settings API endpoint that only administrators are authorized to invoke. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector (AV:A/AC:L/PR:N/UI:N) is materially inconsistent with the vulnerability description, which explicitly requires an authenticated administrator to trigger the flaw - meaning the effective privilege requirement is PR:H, not PR:N, and the attack vector for a web API endpoint is more accurately AV:N than AV:A. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch availability is not confirmed from the provided data - no fixed version is cited in the CERT/CC advisory or EUVD entry. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today