O2OA vulnerabilities

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the Cipher Connection Handler component. Manipulation of the fileUrl argument leads to information disclosure. The attack can be launched remotely, and the exploit has been publicly disclosed and may be used. The vendor was contacted but did not respond.

O2OA version 6.4.7 contains a remote code execution (RCE) vulnerability via the /x_program_center/jaxrs/invoke endpoint. An attacker can send a specially crafted request to execute arbitrary code on the server.

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the sandbox mechanism of the Invoke script execution.

Reflected XSS vulnerability in the forum posting function of O2OA v10 allows attackers to execute arbitrary JavaScript in the victim's browser context via a crafted URL.