Lucene search
JpcertCVELIST:CVE-2023-50294HistoryDec 26, 2023 - 7:21 a.m.
CVE-2023-50294
2023-12-2607:21:19
jpcert
www.cve.org
1
growi
app settings
sensitive information
cleartext
secret access key
external service
attacker
The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.
CNA Affected
[
{
"vendor": "WESEEK, Inc.",
"product": "GROWI",
"versions": [
{
"version": "prior to v6.0.6",
"status": "affected"
}
]
}
]Related
cve
cve
CVE-2023-50294
2023-12-26 08:15:11
prion
prion
Code injection
2023-12-26 08:15:00
osv
osv
CVE-2023-50294
2023-12-26 08:15:11
nvd
nvd
CVE-2023-50294
2023-12-26 08:15:11
jvn
jvn
JVN#18715935: Multiple vulnerabilities in GROWI
2023-12-13 00:00:00