CVE-2018-19620

2018-11-2808:29:00

Google

osv.dev

6.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

47.3%

JSON

ShowDoc 2.4.1 allows remote attackers to edit other users’ notes by navigating with a modified page_id.

CPENameOperatorVersion
showdoceq2.2.1
showdoceq1.6.0
showdoceq2.1.5
showdoceq2.0.7
showdoceq1.4.7
showdoceq1.3.6
showdoceq1.4.1
showdoceq1.3.2
showdoceq1.0.5
showdoceq1.8.0

Name	Operator	Version
showdoc	eq	2.2.1
showdoc	eq	1.6.0
showdoc	eq	2.1.5
showdoc	eq	2.0.7
showdoc	eq	1.4.7
showdoc	eq	1.3.6
showdoc	eq	1.4.1
showdoc	eq	1.3.2
showdoc	eq	1.0.5
showdoc	eq	1.8.0

Rows per page:

1-10 of 781

References

github.com/CCCCCrash/POCs/tree/master/Web/showdoc/IncorrectAccessControl#0x02-modify

github.com/star7th/showdoc/commit/bcdb5e3519285bdf81e618b3c9b90d22bc49e13c

github.com/star7th/showdoc/issues/397