Threats tagged 'ghsa-5rf7-5f5j-9m5j'

A server-side request forgery (SSRF) vulnerability exists in the Coupa Supplier Portal SaaS platform within the document conversion feature under 'Contracts > Templates'. This flaw arises from insufficient validation of external resource references in DOCX files processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated user with template modification rights can upload a crafted DOCX file that triggers the server to access attacker-controlled URLs, internal network resources, or local files. Exploitation may disclose sensitive information such as configuration files, system files, credentials, environment variables, and internal service endpoints.