Lucene search

Japan Vulnerability NotesJVN:00845253

HistoryOct 07, 2022 - 12:00 a.m.

JVN#00845253: Growi vulnerable to improper access control

2022-10-0700:00:00

Japan Vulnerability Notes

jvn.jp

growi

improper access control

cwe-284

update

vulnerability

versions prior to

data download

security advisory

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

40.0%

JSON

GROWI provided by WESEEK, Inc. contains an improper access control vulnerability (CWE-284).

Impact

A user who can login to the affected product may download the markdown data from the pages set to private by the other users.

Solution

Update the software
Update the software to the following versions according to the information provided by the developer.

GROWI v5.1.4 or later (v5 series)
GROWI v4.5.25 or later (v4 series)

Products Affected

GROWI versions prior to v5.1.4 (v5 series)
GROWI versions prior to v4.5.25 (v4 series)

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

40.0%

JSON

Related for JVN:00845253