Airbyte
Monthly
Server-side request forgery in the Airbyte OneDrive source connector allows an authenticated low-privileged user to pass a crafted resource URI to the _get_shared_drive_object method, causing the Airbyte server to make arbitrary outbound requests and disclose information in the service account’s context. The flaw affects Airbyte deployments where the OneDrive connector is available, as reflected by the wildcard CPE for airbyte:airbyte, and carries a CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). No public exploit was identified at time of analysis, and exploitation requires valid authenticated access plus the ability to configure or run the OneDrive source connector.
Server-side request forgery in the Airbyte SharePoint source connector allows an authenticated, low-privilege user to force the Airbyte service to issue arbitrary outbound requests through the unvalidated URI handled by the _get_shared_drive_object method, disclosing information available to the service account's context. Exploitation requires a valid Airbyte account, the ability to use or configure the SharePoint connector, and network reach to the Airbyte instance; available intelligence shows no public exploit identified at time of analysis and no confirmed active exploitation, and the issue is assessed as a credible but second-tier priority. Impact is confidentiality-only (no integrity or availability effect) with changed scope because the requests originate from the service's privileged network position.
Server-side request forgery in the Airbyte OneDrive source connector allows an authenticated low-privileged user to pass a crafted resource URI to the _get_shared_drive_object method, causing the Airbyte server to make arbitrary outbound requests and disclose information in the service account’s context. The flaw affects Airbyte deployments where the OneDrive connector is available, as reflected by the wildcard CPE for airbyte:airbyte, and carries a CVSS 3.1 score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). No public exploit was identified at time of analysis, and exploitation requires valid authenticated access plus the ability to configure or run the OneDrive source connector.
Server-side request forgery in the Airbyte SharePoint source connector allows an authenticated, low-privilege user to force the Airbyte service to issue arbitrary outbound requests through the unvalidated URI handled by the _get_shared_drive_object method, disclosing information available to the service account's context. Exploitation requires a valid Airbyte account, the ability to use or configure the SharePoint connector, and network reach to the Airbyte instance; available intelligence shows no public exploit identified at time of analysis and no confirmed active exploitation, and the issue is assessed as a credible but second-tier priority. Impact is confidentiality-only (no integrity or availability effect) with changed scope because the requests originate from the service's privileged network position.