Threats tagged 'ghsa-mc6j-cg9w-v46r'

Coze Studio versions up to 0.5.1 contain a Server-Side Request Forgery (SSRF) vulnerability that allows authenticated users to make the backend server fetch internal services by supplying arbitrary server URLs when registering plugin tools. This can lead to unauthorized access to cloud metadata endpoints and internal services accessible only from the backend network, potentially exposing sensitive information.