漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Vexa Webhook Feature has a SSRF Vulnerability
Vulnerability Description
Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa webhook feature allows authenticated users to configure an arbitrary URL that receives HTTP POST requests when meetings complete. The application performs no validation on the webhook URL, enabling Server-Side Request Forgery (SSRF). An authenticated attacker can set their webhook URL to target internal services (Redis, databases, admin panels), cloud metadata endpoints (AWS/GCP credential theft), and/or localhost services. Version 0.10.0-260419-1910 patches the issue.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Vulnerability Type
服务端请求伪造(SSRF)
Vulnerability Title
Vexa 安全漏洞
Vulnerability Description
Vexa是Vexa.ai开源的一个开源会议机器人及实时转录API。 Vexa 0.10.0-260419-1910之前版本存在安全漏洞，该漏洞源于Webhook URL缺少验证，可能导致经过身份验证的攻击者进行服务端请求伪造攻击。
CVSS Information
N/A
Vulnerability Type
N/A