PT-2020-18643 · Growi · Growi

Daisuke Takahashi · Published 2020-12-16 · Updated 2020-12-18 · CVE-2020-5683

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions GROWI versions prior to v4.2.3 GROWI versions prior to v4.1.12 GROWI v3 series and earlier

Description A directory traversal vulnerability allows remote attackers to alter data by uploading a specially crafted file. This issue enables attackers to potentially modify or access unauthorized parts of the system.

Recommendations For GROWI versions prior to v4.2.3, update to version v4.2.3 or later. For GROWI versions prior to v4.1.12, update to version v4.1.12 or later. For GROWI v3 series and earlier, update to a version later than v4.1.12 or v4.2.3, as these versions are no longer supported.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-5683

Affected Products

Growi

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-5683 · Security Note
• https://osv.dev/vulnerability/CVE-2020-5683 · Vendor Advisory
• https://github.com/weseek/growi · Note
• https://hub.docker.com/r/weseek/growi · Note
• https://t.me/cibsecurity/20910 · Telegram Post
• https://jvn.jp/en/jp/JVN94169589/index.html · Note