ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Vendor

ONLYOFFICE

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

ONLYOFFICE's ownCloud integration plugin 9.12 has an SSRF flaw (CVE-2026-84282) letting authenticated admins probe internal networks; no patch exists yet.

CERT/CC published VU#943094 for a server-side request forgery in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12, tracked as CVE-2026-84282. The /apps/onlyoffice/ajax/settings/address endpoint does not validate the user-supplied document server URL, so an authenticated administrator can make the ownCloud server send arbitrary requests to localhost and internal hosts. Differences in error responses (connection failures vs SSL/TLS errors) let attackers enumerate open and closed TCP ports for internal reconnaissance. The vendor could not be reached, so no official patch is available; CERT recommends disabling the plugin and applying egress filtering until a fix ships.

CERT/CC Vulnerability Notes · 7d agoVulnerabilityCVE-2026-84282

Related CVEs

  • CVE-2026-842826.5<1%
    SSRF in ONLYOFFICE ownCloud Integration plugin 9.12
    CVE-2026-84282 is a server-side request forgery (SSRF) in the ONLYOFFICE ownCloud Integration plugin version 9.12, where the /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before the ownCloud server makes outbound connections. To trigger it, an authenticated administrator supplies a manipulated 'document server' parameter, causing the server to send requests to attacker-chosen destinations, including localhost and internal network hosts. An attacker gains internal network reconnaissance and can perform TCP port scanning of the ownCloud host's local network by differentiating server responses. Only ownCloud deployments running this integration plugin are affected, and exploitation requires administrative access, so an attacker would typically need a compromised or untrusted admin account. There is no known public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS puts 30-day exploitation probability at 0.2% (6th percentile).
    · ONLYOFFICE ownCloud Integration plugin 9.12moderate

Appears with

organization CERT/CC 1organization ETC JSC 1product ONLYOFFICE ownCloud integration plugin 1product ownCloud 1vendor Ascensio System SIA 1vendor ownCloud 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.