CVE-2021-28060: SSRF

Published Apr 14, 2021

Updated

A Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 allows a remote attacker to forge GET requests to arbitrary URLs via the url parameter to group/api/upload.php.

Affected Software

1 affected component

Group-Office Group Office=6.4.196

Event History

Apr 14, 2021

CVE Published

via MITRE·04:11 PM

Data Sourced

via MITRE·04:11 PM

Description

Frequently Asked Questions

What is CVE-2021-28060?

CVE-2021-28060 is a Server-Side Request Forgery (SSRF) vulnerability in Group Office 6.4.196 that allows a remote attacker to forge GET requests to arbitrary URLs.

What is the severity of CVE-2021-28060?

The severity of CVE-2021-28060 is medium, with a severity value of 5.3.

How does CVE-2021-28060 affect Group Office?

CVE-2021-28060 affects Group Office version 6.4.196, allowing a remote attacker to perform Server-Side Request Forgery (SSRF) attacks.

How can I fix CVE-2021-28060 in Group Office?

To fix CVE-2021-28060 in Group Office, update to a version that is not affected by the vulnerability.

Is there any additional information about CVE-2021-28060?

For additional information about CVE-2021-28060, you can refer to the following sources: [Link 1](https://fatihhcelik.blogspot.com/2020/12/group-office-crm-ssrf.html), [Link 2](https://fatihhcelik.github.io/posts/Group-Office-CRM-SSRF/).