Coupa S Total Spend Management Platform
Monthly
Server-side request forgery in the Coupa Supplier Portal's document conversion feature lets an authenticated user who can modify templates under Contracts > Templates upload a crafted DOCX that causes the server to fetch attacker-chosen external resources, internal network URLs, or local files during DOCX-to-PDF conversion. Impact is primarily confidentiality: disclosure of configuration files, system files, credentials, environment variables and internal service endpoints, with limited integrity and availability effects reflected in the CVSS 4.0 vector (8.4, VC:H/VI:L/VA:L, scope changed). Exploitation is access-gated rather than drive-by - it requires elevated template-management rights (PR:H) and the conversion path being exercised, and no public exploit or in-the-wild activity was identified at time of analysis; INCIBE is the reporting source and vuln.today assigns this a this_week priority.
Server-side request forgery in the Coupa Supplier Portal's document conversion feature lets an authenticated user who can modify templates under Contracts > Templates upload a crafted DOCX that causes the server to fetch attacker-chosen external resources, internal network URLs, or local files during DOCX-to-PDF conversion. Impact is primarily confidentiality: disclosure of configuration files, system files, credentials, environment variables and internal service endpoints, with limited integrity and availability effects reflected in the CVSS 4.0 vector (8.4, VC:H/VI:L/VA:L, scope changed). Exploitation is access-gated rather than drive-by - it requires elevated template-management rights (PR:H) and the conversion path being exercised, and no public exploit or in-the-wild activity was identified at time of analysis; INCIBE is the reporting source and vuln.today assigns this a this_week priority.