CVE-2022-41799 Missing authorization in GROWI v5 series and v4 series
Authenticated attackers can bypass access controls to download private markdown data from other users' pages in GROWI.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-41799?
CVE-2022-41799 is a medium-severity missing authorization vulnerability in WESEEK, Inc. GROWI v5 series and v4 series, published on 24 Oct 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.
Which versions are affected by CVE-2022-41799?
It affects 1 product.
Products include Weseek Growi.
How do I fix CVE-2022-41799?
No fix has been published for CVE-2022-41799 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-41799 being exploited?
There is no known exploitation of CVE-2022-41799 in the wild and no public exploit code.
Other vulnerabilities in WESEEK, Inc. GROWI v5 series and v4 series
Sources
Also known as GHSA-5x4q-5j7v-9cc2.