漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Server-Side Request Forgery in groupoffice
Vulnerability Description
Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.php endpoint. The /api/upload.php endpoint does not filter URLs which allows a malicious user to cause the server to make resource requests to untrusted domains. Note that protocols like file:// can also be used to access the server disk. The request result (on success) can then be retrieved using /api/download.php. This issue has been addressed in versions 6.8.15, 6.7.54, and 6.6.177. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
Group Office CRM 代码问题漏洞
Vulnerability Description
Group Office CRM是一个应用软件。与同事和客户在线共享项目，日历，文件和电子邮件。易于使用且可完全自定义。 Group Office CRM 存在代码问题漏洞，该漏洞源于存在服务器端请求伪造(SSRF)漏洞，允许恶意用户导致服务器向不受信任的域发出资源请求。
CVSS Information
N/A
Vulnerability Type
N/A