Intranda goobi-viewer-core authorization issue vulnerability

A security vulnerability exists in Intranda Goobi Viewer Core versions from 24.03 up to but including 26.05. This vulnerability arises because the DownloadTaskEndpoint WebSocket endpoint /tasks/download/monitor.socket accepts download requests from unauthenticated users, potentially leading to...

Intranda goobi-viewer-core encryption issue vulnerability

Versions of Intranda Goobi Viewer Core prior to 26.05 contain a security vulnerability. This vulnerability arises because, when accessing the password reset link, a predictable method is used to generate a new password. Due to insufficient entropy, this may allow attackers to brute-force the...

Intranda goobi-viewer-core path traversal vulnerability

A security vulnerability exists in Intranda Goobi Viewer Core versions from 24.03 up to but not including 26.05. This vulnerability arises because ExternalFilesDownloader.getFilename extracts the target filename from the Content-Disposition response header provided by the server and passes it...

Intranda goobi-viewer-core input validation error vulnerability

A security vulnerability exists in Intranda Goobi Viewer Core versions from 25.08 up to but not including 26.05. This vulnerability stems from the auth/login and auth/token endpoints in IIIF Auth 2.0 accepting unvalidated origin query parameters in AuthorizationFlowResource. These parameters are...