CVE-2023-50332 Missing authorization in GROWI

Medium 6.5 Published 26 Dec 2023 Updated 2 Aug 2024

Attackers can delete or suspend user accounts without authorization due to improper checks in the user management interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-50332?

CVE-2023-50332 is a medium-severity missing authorization vulnerability in WESEEK, Inc. GROWI, published on 26 Dec 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user's intention.

Which versions are affected by CVE-2023-50332?

It affects 1 product.

Products include Weseek Growi.

How do I fix CVE-2023-50332?

No fix has been published for CVE-2023-50332 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-50332 being exploited?

There is no known exploitation of CVE-2023-50332 in the wild and no public exploit code.

Sources

Also known as GHSA-9q5r-h9jj-276p.