PT-2023-31526 · Growi · Growi

Norihide Saito · Published 2023-12-26 · Updated 2024-01-02 · CVE-2023-50294

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GROWI versions prior to v6.0.6

Description The issue concerns the storage of sensitive information in cleartext form on the App Settings page, located at "/admin/app". This could allow an attacker with access to the page to obtain the Secret access key for an external service.

Recommendations For versions prior to v6.0.6, update to version v6.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the App Settings page (/admin/app) to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2023-50294

Affected Products

Growi

References · 6

• https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-50294 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50294 · Security Note
• https://jvn.jp/en/jp/JVN18715935 · Note
• https://twitter.com/CVEnew/status/1739551029375418787 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1739615828843102685 · Twitter Post