PT-2020-18642 · Growi · Growi

Norihide Saito · Published 2020-12-16 · Updated 2021-07-21 · CVE-2020-5682

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions GROWI versions prior to v4.2.3 GROWI versions prior to v4.1.12 GROWI v3 series and earlier

Description The issue is caused by improper input validation, allowing remote attackers to cause a denial of service via unspecified vectors.

Recommendations For GROWI versions prior to v4.2.3, update to version v4.2.3 or later. For GROWI versions prior to v4.1.12, update to version v4.1.12 or later. For GROWI v3 series and earlier, update to a version later than v3.

Fix

RCE

Resource Exhaustion

Weakness Enumeration

CWE-20

CWE-400

Related Identifiers

CVE-2020-5682

Affected Products

Growi

References · 7

• https://osv.dev/vulnerability/CVE-2020-5682 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5682 · Security Note
• https://github.com/weseek/growi · Note
• https://t.me/cibsecurity/20906 · Telegram Post
• https://hub.docker.com/r/weseek/growi · Note
• https://jvn.jp/en/jp/JVN94169589/index.html · Note
• https://t.me/cvenotify/7347 · Telegram Post