CVE-2021-43781

🗓️ 06 Dec 2021 17:45:10Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 88 Views🌐 WEB

Invenio-Drafts-Resources submission/deposit module for Invenio, does not check permissions properly when publishing record

Reporter	Title	Published	Views	Family All 19
Circl	CVE-2021-43781	6 Dec 202120:20	–	circl
CNNVD	Invenio-Drafts-Resources 安全漏洞	6 Dec 202100:00	–	cnnvd
Cvelist	CVE-2021-43781 Permissions not properly checked in Invenio-Drafts-Resources	6 Dec 202117:45	–	cvelist
EUVD	EUVD-2021-0102	7 Oct 202500:30	–	euvd
Github Security Blog	Permissions not properly checked in Invenio-Drafts-Resources	6 Dec 202123:57	–	github
Mend	CVE-2021-43781	6 Dec 202117:45	–	mend
NVD	CVE-2021-43781	6 Dec 202118:15	–	nvd
osv_ghsa	GHSA-XR38-W74Q-R8JV Permissions not properly checked in Invenio-Drafts-Resources	6 Dec 202123:57	–	osv_ghsa
osv_pysec	PYSEC-2021-836	6 Dec 202118:15	–	osv_pysec
osv_pysec	PYSEC-2021-837	6 Dec 202118:15	–	osv_pysec

NVD

Vulners

Node

inveniosoftware invenio-drafts-resourcesRange<0.13.7

inveniosoftware invenio-drafts-resourcesRange0.14.0–0.14.6

[
  {
    "product": "invenio-drafts-resources",
    "vendor": "inveniosoftware",
    "versions": [
      {
        "status": "affected",
        "version": "< 0.13.7"
      },
      {
        "status": "affected",
        "version": ">= 0.14.0, < 0.14.6"
      }
    ]
  }
]

Source	Link
github	www.github.com/inveniosoftware/invenio-drafts-resources/commit/039b0cff1ad4b952000f4d8c3a93f347108b6626
github	www.github.com/inveniosoftware/invenio-drafts-resources/security/advisories/GHSA-xr38-w74q-r8jv

Parameter	Position	Path	Description	CWE
id	path	/api/v1/drafts/	Authenticated users can publish draft records belonging to other users by providing the record identifier via the REST API.	CWE-862, CWE-863

17 Jun 2026 04:11Current

4.6Medium risk

Vulners AI Score4.6

CVSS 24

CVSS 3.14.3 - 6.4

EPSS0.00684