O2OA vulnerabilities

A security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file o2server/x_base_core_project/src/main/java/com/x/base/core/project/connection/CipherConnectionAction.java of the Cipher Connection Handler component. Manipulation of the fileUrl argument leads to information disclosure. The attack can be launched remotely, and the exploit has been publicly disclosed and may be used. The vendor was contacted but did not respond.

O2OA version 6.4.7 contains a remote code execution (RCE) vulnerability via the /x_program_center/jaxrs/invoke endpoint. An attacker can send a specially crafted request to execute arbitrary code on the server.

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes.

A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/jaxrs/excel/upload/with/url of the component General Module. Executing a manipulation of the argument fileUrl can lead to server-side request forgery. The attack can be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the sandbox mechanism of the Invoke script execution.

Reflected XSS vulnerability in the forum posting function of O2OA v10 allows attackers to execute arbitrary JavaScript in the victim's browser context via a crafted URL.

A vulnerability was detected in O2OA up to 10.0-410 in an unknown function of the /x_query_assemble_designer/jaxrs/importmodel file within the Personal Profile Page component. Manipulation of the description/applicationName/queryName arguments results in cross site scripting, and the attack can be carried out remotely. The exploit is public and the vendor stated it will be fixed in a new version.

A cross-site scripting (XSS) vulnerability was detected in O2OA up to version 10.0-410. It affects an unknown function in the file /x_query_assemble_designer/jaxrs/statement of the Personal Profile Page component and is triggered by manipulating the description/queryName argument. The attack can be launched remotely and the exploit has been publicly disclosed.

A weakness has been identified in O2OA up to 10.0-410 affecting an unknown function of the file /x_query_assemble_designer/jaxrs/table within the Personal Profile Page component. Manipulation of the description/applicationName/queryName arguments causes cross site scripting, and the attack may be initiated remotely. The exploit has been made available to the public and could be exploited; the vendor stated it will be fixed in a new version.

A cross-site scripting (XSS) security flaw was discovered in O2OA up to version 10.0-410. It affects an unknown function in the file /x_query_assemble_designer/jaxrs/stat of the Personal Profile Page component, where manipulation of the name/alias/description/applicationName arguments leads to script execution. The attack can be launched remotely and the exploit has been released publicly.

A weakness has been identified in O2OA up to 10.0-410 affecting unknown code of the file /x_processplatform_assemble_designer/jaxrs/script within the Personal Profile Page component. Manipulation of the name/alias/description/applicationName arguments can lead to cross site scripting, and the attack can be executed remotely. The exploit has been made available to the public and could be exploited.

A cross-site scripting (XSS) security flaw was discovered in O2OA up to version 10.0-410. It affects an unknown part of the file /x_processplatform_assemble_designer/jaxrs/process of the Personal Profile Page component, where manipulation of the name/alias arguments leads to script execution. Remote exploitation is possible and the exploit has been released publicly.

A vulnerability was identified in O2OA up to 10.0-410 in the file /x_organization_assemble_control/jaxrs/unit/ within the Personal Profile Page component. Manipulation of the name/shortName/distinguishedName/pinyin/pinyinInitial/levelName arguments leads to cross site scripting. The attack can be launched remotely and the exploit is publicly available.

A cross-site scripting (XSS) vulnerability was found in O2OA up to version 10.0-410 in the /x_processplatform_assemble_designer/jaxrs/form file of the Personal Profile Page component. Manipulating the name/alias/description arguments leads to malicious script execution. The exploit has been publicly disclosed, and the vendor stated a fix will be included in a new version.

A cross-site scripting (XSS) vulnerability was found in O2OA up to version 10.0-410. It affects an unknown function in the file /x_cms_assemble_control/jaxrs/script of the Personal Profile Page component, where manipulation of the name/alias/description arguments leads to script execution. The attack can be launched remotely and the exploit has been made public.

A cross-site scripting (XSS) vulnerability was found in O2OA up to version 10.0-410. It affects some unknown functionality in the file /x_cms_assemble_control/jaxrs/form of the Personal Profile Page component, where manipulation leads to script execution. The attack can be launched remotely and the exploit has been made public.

A cross-site scripting (XSS) vulnerability was found in O2OA up to version 10.0-410. It affects an unknown functionality in the file /x_cms_assemble_control/jaxrs/design/appdict of the Personal Profile Page component, where manipulation leads to script execution. The attack may be initiated remotely and the exploit has been disclosed to the public.

A cross-site scripting (XSS) flaw was found in O2OA up to version 10.0-410. It affects an unknown function in the file /x_program_center/jaxrs/agent of the Personal Profile Page component, where manipulation leads to script execution. The attack can be launched remotely and the exploit has been published.

In O2OA up to 10.0-410, the personal profile page at /x_portal_assemble_designer/jaxrs/page is vulnerable to cross-site scripting. The attack can be initiated remotely and the exploit is publicly available; the vendor stated a fix will be included in a new version.

A vulnerability was found in O2OA up to 10.0-410 in the file /x_portal_assemble_designer/jaxrs/widget within the Personal Profile Page component. Manipulation leads to cross site scripting. The attack can be executed remotely and the exploit has been disclosed publicly; the vendor stated it will be fixed in the new version.

A flaw was found in O2OA up to 10.0-410 in the file /x_portal_assemble_designer/jaxrs/dict/ within the Personal Profile Page component. Manipulation of the name/alias/description arguments causes cross site scripting. Remote exploitation is possible and the exploit has been published; the vendor stated it will be fixed in the new version.

A vulnerability was detected in O2OA up to 10.0-410 in the file /x_program_center/jaxrs/script within the Personal Profile Page component. Manipulation of the name/alias/description arguments results in cross site scripting. The attack can be launched remotely and the exploit is public; the vendor stated it will be fixed in the new version.

A weakness was identified in O2OA up to 10.0-410 in the file /x_organization_assemble_control/jaxrs/person/ within the Personal Profile Page component. Manipulation of the Description argument can lead to cross site scripting. The attack can be launched remotely; the vendor stated it will be fixed in the new version.

A security flaw was discovered in O2OA up to 10.0-410 in the file /x_organization_assemble_personal/jaxrs/definition/calendarConfig. Manipulation of the toMonthViewName argument results in cross site scripting. The attack can be launched remotely and the exploit has been released publicly; the vendor stated it will be fixed in the new version.