Coupa Supplier Portal template document conversion SSRF
Internal data on the Coupa purchasing service can be peeked at.
Summary
A server-side request forgery flaw in the document conversion feature of Coupa Supplier Portal's Contracts > Templates section lets an authenticated user with template-editing permission make the server read internal resources or local files. A crafted DOCX file can expose configuration files, system files and credentials.
Affected when
- Authenticated user with template-editing permission
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen