CVE-2022-41799

2022-10-2400:00:00

jpcert

www.cve.org

improper access control

growi

authenticated attacker

download

private data

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

39.9%

JSON

Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.

CNA Affected

[
  {
    "vendor": "WESEEK, Inc.",
    "product": "GROWI v5 series and v4 series",
    "versions": [
      {
        "version": "versions prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series)",
        "status": "affected"
      }
    ]
  }
]