GHSA-QRMM-W4V4-Q7F8高危已审查

Unauthorized access through URL manipulation

OSV 1.4.0 · github-reviewed · 修改于 2021-05-06 02:45

发布时间

2021-05-06 23:27

GitHub 审查时间

2021-05-06 02:45

NVD 发布时间

—

源文件

advisories/github-reviewed/2021/05/GHSA-qrmm-w4v4-q7f8/GHSA-qrmm-w4v4-q7f8.json

公告说明

Impact

The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation.

Patches

The vulnerability has been patched in version 1.2.65 of the master branch, version 1.1.113 of the 1.1.x series, and version 1.0.12 of the stable branch. The Docker image on docker.io has been patched.

Workarounds

If upgrading is not possible, manually apply the changes of https://github.com/jhpyle/docassemble/commit/e3dbf6ce054b3c0310996f0657289f5eed0a73fe and restart the server (e.g., by pressing Save on the Configuration screen).

Credit

The vulnerability was discovered by Jim Platania of Seiso LLC (@jimmio).

For more information

If you have any questions or comments about this advisory:

Open an issue in docassemble
Join the Slack channel
Email us at [email protected]

受影响的软件包

标识信息

别名 / CVE

无

CWE

CWE-552

软件生态

PyPI

扩展资料

暂无扩展资料。

CVSS 评分

没有 CVSS 数据。

原始 OSV JSON

{
  "id": "GHSA-qrmm-w4v4-q7f8",
  "aliases": [],
  "details": "### Impact\nThe vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation.\n\n### Patches\nThe vulnerability has been patched in version 1.2.65 of the `master` branch, version 1.1.113 of the 1.1.x series, and version 1.0.12 of the `stable` branch. The Docker image on docker.io has been patched.\n\n### Workarounds\nIf upgrading is not possible, manually apply the changes of https://github.com/jhpyle/docassemble/commit/e3dbf6ce054b3c0310996f0657289f5eed0a73fe and restart the server (e.g., by pressing Save on the Configuration screen).\n\n### Credit\nThe vulnerability was discovered by Jim Platania of Seiso LLC (@jimmio).\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [docassemble](https://github.com/jhpyle/docassemble/issues)\n* Join the [Slack channel](https://join.slack.com/t/docassemble/shared_invite/zt-ohrn8y9z-_Fb3RAl~JPBU6Km7odBPfQ)\n* Email us at [[email protected]](mailto:[email protected])\n",
  "summary": "Unauthorized access through URL manipulation",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.65"
            }
          ]
        }
      ],
      "package": {
        "name": "docassemble",
        "ecosystem": "PyPI"
      }
    }
  ],
  "modified": "2021-05-05T18:45:36Z",
  "severity": [],
  "published": "2021-05-06T15:27:22Z",
  "references": [
    {
      "url": "https://github.com/jhpyle/docassemble/security/advisories/GHSA-qrmm-w4v4-q7f8",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-552"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2021-05-05T18:45:36Z"
  }
}