A weakness in the FileAction function of the URL Fetching component in o2oa up to version 10.0 allows an attacker to manipulate the fileUrl parameter so that the server makes HTTP requests to arbitrary internal or external resources. This ability can lead to the disclosure of internal network information, credential extraction, or the proxying of malicious content. The impact is a loss of confidentiality and potential integrity compromise of internal resources, and it is detectable only when the server is reachable by the attacker.

Vendors affected are the o2oa application ecosystem. The specific affected module is FileAction.java in the URL Fetching component, with all releases up to and including 10.0 identified as vulnerable. No fixed version is documented in the provided vendor information.

The CVSS score of 5.3 gives the vulnerability a moderate severity rating. EPSS data is not available, so it is unclear how frequently this exploit is being used in the wild, but the existence of a publicly available exploit suggests that an attack is feasible. The vulnerability is not listed in the CISA KEV catalog. A likely attack vector is remote exploitation via a crafted HTTP request to an endpoint that invokes the vulnerable FileAction function. No specific conditions such as authentication are mentioned, which implies that any user who can invoke the function may launch the attack.