Threats tagged 'ghsa-v4j8-r967-w6rg'

Budibase server versions prior to 3.45.0 contain a server-side request forgery (SSRF) vulnerability in the Microsoft Teams webhook endpoint. This flaw allows unauthenticated attackers to submit crafted POST requests with attacker-controlled serviceUrl values, which are persisted and used in subsequent bot replies. Exploitation can lead to the server sending live Microsoft OAuth access tokens to attacker-controlled hosts and enable blind internal network access. The vulnerability has a medium severity with a CVSS 4.0 score of 6.3.