VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability
ONLYOFFICE's ownCloud integration plugin 9.12 has an SSRF flaw (CVE-2026-84282) letting authenticated admins probe internal networks; no patch exists yet.
CERT/CC published VU#943094 for a server-side request forgery in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12, tracked as CVE-2026-84282. The /apps/onlyoffice/ajax/settings/address endpoint does not validate the user-supplied document server URL, so an authenticated administrator can make the ownCloud server send arbitrary requests to localhost and internal hosts. Differences in error responses (connection failures vs SSL/TLS errors) let attackers enumerate open and closed TCP ports for internal reconnaissance. The vendor could not be reached, so no official patch is available; CERT recommends disabling the plugin and applying egress filtering until a fix ships.
- SSRF in ONLYOFFICE ownCloud integration plugin 9.12
- Authenticated admins can reach localhost and internal hosts
- Error-based side channels reveal open/closed TCP ports
- No vendor patch; disable plugin and apply egress controls
- Reported by ETC JSC researchers via CERT/CC
- CVEs
- CVE-2026-84282
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84282 | SSRF in ONLYOFFICE ownCloud Integration plugin 9.12 | 6.5 | <1% |
From the original article
2 min read at kb.cert.orgOverview A Server-Side Request Forgery (SSRF) vulnerability exists in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin (version 9. 12). The plugin’s backend endpoint does not adequately validate the user‑supplied document server URL before initiating outbound connections.
kb.cert.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.