CVE-2026-92602

Опубликовано: 16 сент. 2026

Источник: nvd

CVSS3: 7.1

Описание

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.

Ссылки

https://github.com/TDuckCloud/tduck-survey-form
https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/controller/WebhookConfigController.java#L43-L47
https://github.com/TDuckCloud/tduck-survey-form/blob/9ad4e2dc75cdff5eacc8be0c73f0d4db3c265d43/tduck-webhook/src/main/java/com/tduck/cloud/webhook/service/sender/WebhookSenderService.java#L84-L100
https://github.com/TDuckCloud/tduck-survey-form/issues/40
https://www.vulncheck.com/advisories/tduck-survey-form-through-5.3-server-side-request-forgery-via-unvalidated-webhook-url

Связанные уязвимости

GHSA-j7wg-fgxp-4h6h

CVSS3: 7.1

github

1 день назад