PT-2023-31526 · Growi · Growi

Norihide Saito · Publicado 2023-12-26 · Atualizado 2024-01-02 · CVE-2023-50294

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GROWI versions prior to v6.0.6

Description The issue concerns the storage of sensitive information in cleartext form on the App Settings page, located at "/admin/app". This could allow an attacker with access to the page to obtain the Secret access key for an external service.

Recommendations For versions prior to v6.0.6, update to version v6.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the App Settings page (/admin/app) to minimize the risk of exploitation.

Correção

Cleartext Storage of Sensitive Information

Enumeração de Fraquezas

CWE-312

Identificadores relacionados

CVE-2023-50294

Produtos afetados

Growi

Referências · 6

• https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6 · Aviso do Fabricante
• https://jvn.jp/en/jp/JVN18715935 · Nota
• https://osv.dev/vulnerability/CVE-2023-50294 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-50294 · Nota de Segurança
• https://twitter.com/CVEnew/status/1739551029375418787 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1739615828843102685 · Publicação no Twitter