CVE-2021-4119 Improper Access Control in bookstackapp/bookstack
An attacker can bypass access controls in BookStack to read or modify unauthorized data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-4119?
CVE-2021-4119 is a medium-severity missing authorization vulnerability in bookstackapp/bookstack, published on 15 Dec 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
bookstack is vulnerable to Improper Access Control
Weakness: CWE-284
Which versions are affected by CVE-2021-4119?
2 open source packages ship an affected version, including ssddanbrown/bookstack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ssddanbrown/bookstack Packagist | All versions | 21.11.3 |
ssddanbrown/bookstack Packagist | All versions | 21.11.3 |
Products include Bookstackapp Bookstack.
How do I fix CVE-2021-4119?
Upgrade ssddanbrown/bookstack to 21.11.3 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-4119 being exploited?
There is no known exploitation of CVE-2021-4119 in the wild and no public exploit code.
Other vulnerabilities in bookstackapp/bookstack
- CVE-2020-5256 Remote Code Execution Through Image Uploads in BookStack
- CVE-2020-26210 Cross-Site Scripting in BookStack
- CVE-2020-26211 Cross-Site Scripting in BookStack
- CVE-2022-0877 Cross-site Scripting (XSS) - Stored in bookstackapp/bookstack
- CVE-2021-3915 Unrestricted Upload of File with Dangerous Type in bookstackapp/bookstack
Sources
Also known as GHSA-9c5c-5j4h-8q2c.