Lucene search

MitreCVE-2019-13337

HistoryJul 09, 2019 - 8:15 p.m.

CVE-2019-13337

2019-07-0920:15:10

CWE-639

CWE-863

mitre

web.nvd.nist.gov

weseek growi

cve-2019-13337

security bypass

basic authentication

access_token

api vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

35.9%

JSON

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.

Affected configurations

Nvd

Node

weseekgrowiRange<3.5.0

VendorProductVersionCPE
weseekgrowi*cpe:2.3:a:weseek:growi:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
weseek	growi	*	cpe:2.3:a:weseek:growi::::::::

References

gist.github.com/polkaman/d039fb5236a043907e44efc198d9161c

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

35.9%

JSON

Related for CVE-2019-13337