{"id":"CVE-2026-84282","title":"A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12","summary":"A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server UR…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-918","CWE-20","CWE-601"],"vendor":"Ascensio System SIA / OnlyOffice","product":"ONLYOFFICE ownCloud integration plugin","affected":["onlyoffice_owncloud_integration_plugin 9.12"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T18:18:09.300","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84282","references":[{"url":"https://github.com/ONLYOFFICE/onlyoffice-owncloud/blob/master/controller/settingsapicontroller.php","label":"cret@cert.org"},{"url":"https://kb.cert.org/vuls/id/943094","label":"cret@cert.org"},{"url":"https://www.kb.cert.org/vuls/id/943094","label":"af854a3a-2127-422b-91ae-364da2661108"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-10T17:58:23.276605Z"},"epss":0.00201,"epssPercentile":0.10232,"ingestedAt":"2026-09-08T15:33:26.986Z","slug":"CVE-2026-84282","body":"## Overview\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202015,"id":"CVE-2026-84282","ts":1789400026972,"field":"cvss","old":null,"new":"6.5"},{"seq":202014,"id":"CVE-2026-84282","ts":1789400026972,"field":"severity","old":"none","new":"medium"},{"seq":200742,"id":"CVE-2026-84282","ts":1789397602369,"field":"cvss","old":"6.5","new":null},{"seq":200741,"id":"CVE-2026-84282","ts":1789397602369,"field":"severity","old":"medium","new":"none"},{"seq":199437,"id":"CVE-2026-84282","ts":1789395512055,"field":"cvss","old":null,"new":"6.5"},{"seq":199436,"id":"CVE-2026-84282","ts":1789395512055,"field":"severity","old":"none","new":"medium"},{"seq":198682,"id":"CVE-2026-84282","ts":1789392206023,"field":"cvss","old":"6.5","new":null},{"seq":198681,"id":"CVE-2026-84282","ts":1789392206023,"field":"severity","old":"medium","new":"none"},{"seq":197015,"id":"CVE-2026-84282","ts":1789384288445,"field":"cvss","old":null,"new":"6.5"},{"seq":197014,"id":"CVE-2026-84282","ts":1789384288445,"field":"severity","old":"none","new":"medium"},{"seq":196373,"id":"CVE-2026-84282","ts":1789383755286,"field":"cvss","old":"6.5","new":null},{"seq":196372,"id":"CVE-2026-84282","ts":1789383755286,"field":"severity","old":"medium","new":"none"},{"seq":195301,"id":"CVE-2026-84282","ts":1789380567803,"field":"cvss","old":null,"new":"6.5"},{"seq":195300,"id":"CVE-2026-84282","ts":1789380567803,"field":"severity","old":"none","new":"medium"},{"seq":194144,"id":"CVE-2026-84282","ts":1789378754638,"field":"cvss","old":"6.5","new":null},{"seq":194143,"id":"CVE-2026-84282","ts":1789378754638,"field":"severity","old":"medium","new":"none"},{"seq":192931,"id":"CVE-2026-84282","ts":1789376506011,"field":"cvss","old":null,"new":"6.5"},{"seq":192930,"id":"CVE-2026-84282","ts":1789376506011,"field":"severity","old":"none","new":"medium"},{"seq":191718,"id":"CVE-2026-84282","ts":1789373609966,"field":"cvss","old":"6.5","new":null},{"seq":191717,"id":"CVE-2026-84282","ts":1789373609966,"field":"severity","old":"medium","new":"none"},{"seq":190503,"id":"CVE-2026-84282","ts":1789369461929,"field":"cvss","old":null,"new":"6.5"},{"seq":190502,"id":"CVE-2026-84282","ts":1789369461929,"field":"severity","old":"none","new":"medium"},{"seq":189290,"id":"CVE-2026-84282","ts":1789368388605,"field":"cvss","old":"6.5","new":null},{"seq":189289,"id":"CVE-2026-84282","ts":1789368388605,"field":"severity","old":"medium","new":"none"},{"seq":188073,"id":"CVE-2026-84282","ts":1789365226487,"field":"cvss","old":null,"new":"6.5"},{"seq":188072,"id":"CVE-2026-84282","ts":1789365226487,"field":"severity","old":"none","new":"medium"},{"seq":186860,"id":"CVE-2026-84282","ts":1789363465908,"field":"cvss","old":"6.5","new":null},{"seq":186859,"id":"CVE-2026-84282","ts":1789363465908,"field":"severity","old":"medium","new":"none"},{"seq":185646,"id":"CVE-2026-84282","ts":1789361214179,"field":"cvss","old":null,"new":"6.5"},{"seq":185645,"id":"CVE-2026-84282","ts":1789361214179,"field":"severity","old":"none","new":"medium"},{"seq":184433,"id":"CVE-2026-84282","ts":1789358340871,"field":"cvss","old":"6.5","new":null},{"seq":184432,"id":"CVE-2026-84282","ts":1789358340871,"field":"severity","old":"medium","new":"none"},{"seq":182684,"id":"CVE-2026-84282","ts":1789354312486,"field":"cvss","old":null,"new":"6.5"},{"seq":182683,"id":"CVE-2026-84282","ts":1789354312486,"field":"severity","old":"none","new":"medium"},{"seq":181477,"id":"CVE-2026-84282","ts":1789353310670,"field":"cvss","old":"6.5","new":null},{"seq":181476,"id":"CVE-2026-84282","ts":1789353310670,"field":"severity","old":"medium","new":"none"},{"seq":180270,"id":"CVE-2026-84282","ts":1789350274908,"field":"cvss","old":null,"new":"6.5"},{"seq":180269,"id":"CVE-2026-84282","ts":1789350274908,"field":"severity","old":"none","new":"medium"},{"seq":179063,"id":"CVE-2026-84282","ts":1789348271597,"field":"cvss","old":"6.5","new":null},{"seq":179062,"id":"CVE-2026-84282","ts":1789348271597,"field":"severity","old":"medium","new":"none"},{"seq":177856,"id":"CVE-2026-84282","ts":1789346364550,"field":"cvss","old":null,"new":"6.5"},{"seq":177855,"id":"CVE-2026-84282","ts":1789346364550,"field":"severity","old":"none","new":"medium"},{"seq":176649,"id":"CVE-2026-84282","ts":1789343170802,"field":"cvss","old":"6.5","new":null},{"seq":176648,"id":"CVE-2026-84282","ts":1789343170802,"field":"severity","old":"medium","new":"none"},{"seq":174766,"id":"CVE-2026-84282","ts":1789334871742,"field":"cvss","old":null,"new":"6.5"},{"seq":174765,"id":"CVE-2026-84282","ts":1789334871742,"field":"severity","old":"none","new":"medium"},{"seq":173561,"id":"CVE-2026-84282","ts":1789333683611,"field":"cvss","old":"6.5","new":null},{"seq":173560,"id":"CVE-2026-84282","ts":1789333683611,"field":"severity","old":"medium","new":"none"},{"seq":172375,"id":"CVE-2026-84282","ts":1789331088629,"field":"cvss","old":null,"new":"6.5"},{"seq":172374,"id":"CVE-2026-84282","ts":1789331088629,"field":"severity","old":"none","new":"medium"}]}