PT-2021-23929 · Unknown+1 · Inveniordm+2

Lnielsen · Published 2021-12-06 · Updated 2022-07-25 · CVE-2021-43781

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Invenio-Drafts-Resources versions prior to 0.13.7 and 0.14.6

Description: Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. The issue arises from improper permission checks when a record is published, making it exploitable in a default installation of InvenioRDM. An authenticated user can publish draft records of other users via REST API calls if they know the record identifier and the draft validates. However, the attacker cannot modify the data in the record, such as changing a record from restricted to public.

Recommendations: For Invenio-Drafts-Resources versions prior to 0.13.7, update to version 0.13.7 or later. For Invenio-Drafts-Resources versions prior to 0.14.6, update to version 0.14.6 or later. As a temporary workaround, consider restricting access to the REST API endpoints related to publishing draft records until a patch is applied.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2021-43781

GHSA-XR38-W74Q-R8JV

PYSEC-2021-836

PYSEC-2021-837

PYSEC-2021-838

Affected Products

Invenio

Invenio-Drafts-Resources

Inveniordm

References · 12

• 🔥 https://github.com/inveniosoftware/invenio-drafts-resources/security/advisories/GHSA-xr38-w74q-r8jv · Exploit
• https://github.com/inveniosoftware/invenio-drafts-resources/commit/039b0cff1ad4b952000f4d8c3a93f347108b6626 · Patch
• https://osv.dev/vulnerability/CVE-2021-43781 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xr38-w74q-r8jv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43781 · Security Note
• https://osv.dev/vulnerability/PYSEC-2021-838 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-837 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-836 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/invenio-app-rdm/PYSEC-2021-837.yaml · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/invenio-drafts-resources/PYSEC-2021-836.yaml · Note
• https://t.me/cibsecurity/33396 · Telegram Post
• https://t.me/cvenotify/24422 · Telegram Post