Threats tagged 'ghsa-wrr5-j383-f7h2'

NocoBase version 2.1.10 and certain alpha releases of 2.2.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the @nocobase/plugin-action-custom-request plugin. A low-privileged authenticated user can override the stored request URL at runtime via the customRequests:send endpoint, causing the server to make arbitrary HTTP requests to attacker-controlled or internal URLs. This occurs if the SERVER_REQUEST_WHITELIST environment variable is not set, bypassing whitelist checks. The vulnerability has a moderate severity with a CVSS score of 4.3. Fixed versions include 2.1.15 and 2.2.0-alpha.4.