Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
This allows an attacker to send a single request with an invalid header and take the service offline. This issue was introduced in version 1.4.2 when the regular expression was updated to attempt to match the behaviour required by errata associated with RFC7230. The regular expression that is used to validate incoming headers has been updated in version 1.4.3, it is recommended that people upgrade to the new version of Waitress as soon as possible. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Pylons/waitress/security/advisories/GHSA-73m2-3pwg-5fgc - https://github.com/Pylons/waitress/commit/6e46f9e3f014d64dd7d1e258eaf626e39870ee1f
CVE ID: CVE-2020-5237 State: PUBLISHED Published: 2020-02-05T13:55:16 Last Updated: 2024-08-04T08:22:09.051Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: 1up-lab Products: oneup/uploader-bundle Problem Types: CWE-23 Description: Multiple relative path traversal vulnerabilities in the oneup/uploader-bundle before 1.9.3 and 2.1.5 allow remote attackers to upload, copy, and modify files on the filesystem (potentially leading to arbitrary code execution) via the (1) filename parameter to BlueimpController.php; the (2) dzchunkindex, (3) dzuuid, or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to Fi
or (4) filename parameter to DropzoneController.php; the (5) qqpartindex, (6) qqfilename, or (7) qquuid parameter to FineUploaderController.php; the (8) x-file-id or (9) x-file-name parameter to MooUploadController.php; or the (10) name or (11) chunk parameter to PluploadController.php. This is fixed in versions 1.9.3 and 2.1.5. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/1up-lab/OneupUploaderBundle/security/advisories/GHSA-x8wj-6m73-gfqp - https://github.com/1up-lab/OneupUploaderBundle/commit/a6011449b716f163fe1ae323053077e59212350c - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-003.txt
CVE ID: CVE-2020-5238 State: PUBLISHED Published: 2020-07-01T23:05:15 Last Updated: 2024-08-04T08:22:09.078Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: github Products: cmark-gfm Problem Types: CWE-20 Description: The table extension in GitHub Flavored Markdown before version 0.29.0.gfm.1 takes O(n * n) time to parse certain inputs. An attacker could craft a markdown table which would take an unreasonably long time to process, causing a denial of service. This issue does not affect the upstream cmark project. The issue has been fixed in version 0.29.0.gfm.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/github/cmark
n version 0.29.0.gfm.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/github/cmark-gfm/security/advisories/GHSA-7gc6-9qr5-hc85 - https://github.com/github/cmark-gfm/commit/85d895289c5ab67f988ca659493a64abb5fec7b4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TCDHBTUFIOYRIS5HAS6PZNBNMB7IOAX3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZGJH2A4VAV54X6NSCNNGSEIGIIY5N2VR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WMQFOQQCWOAMQ4I2XIVCVOXXIJ75HDCW/
CVE ID: CVE-2020-5239 State: PUBLISHED Published: 2020-02-13T00:20:13 Last Updated: 2024-08-04T08:22:09.018Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: Mailu Products: Mailu Problem Types: CWE-863 Description: In Mailu before version 1.7, an authenticated user can exploit a vulnerability in Mailu fetchmail script and gain full access to a Mailu instance. Mailu servers that have open registration or untrusted users are most impacted. The master and 1.7 branches are patched on our git repository. All Docker images published on docker.io/mailu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afte
ilu for tags 1.5, 1.6, 1.7 and master are patched. For detailed instructions about patching and securing the server afterwards, see https://github.com/Mailu/Mailu/issues/1354 Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Mailu/Mailu/security/advisories/GHSA-2467-p5gv-58q6 - https://github.com/Mailu/Mailu/issues/1354
CVE ID: CVE-2020-5240 State: PUBLISHED Published: 2020-03-13T21:20:14 Last Updated: 2024-08-04T08:22:09.090Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:N) Vendors: Lab Digital Products: wagtail-2fa Problem Types: CWE-285 Description: In wagtail-2fa before 1.4.1, any user with access to the CMS can view and delete other users 2FA devices by going to the correct path. The user does not require special permissions in order to do so. By deleting the other users device they can disable the target users 2FA devices and potentially compromise the account if they figure out their password. The problem has been patched in version 1.4.1. Additional Analyst Notes: - CVE Program
f they figure out their password. The problem has been patched in version 1.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/labd/wagtail-2fa/security/advisories/GHSA-9gjv-6qq6-v7qm - https://github.com/labd/wagtail-2fa/commit/ac23550d33b7436e90e3beea904647907eba5b74
CVE ID: CVE-2020-5241 State: PUBLISHED Published: 2020-02-12T23:40:11 Last Updated: 2024-08-04T08:22:09.024Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: matestack Products: matestack-ui-core Problem Types: CWE-80 Description: matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/matestack/matestack-ui-core/security/advisories/GHSA-3jqw-vv45-mjhh
CVE ID: CVE-2020-5242 State: PUBLISHED Published: 2020-02-20T22:55:13 Last Updated: 2024-08-04T08:22:09.118Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: openhab Products: openhab-addons Problem Types: CWE-284 Description: openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file which cannot be changed via REST calls. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openhab/openhab-addons
a REST calls. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openhab/openhab-addons/security/advisories/GHSA-w698-693g-23hv - https://github.com/openhab/openhab-addons/commit/4c4cb664f2e2c3866aadf117d22fb54aa8dd0031
CVE ID: CVE-2020-5243 State: PUBLISHED Published: 2020-02-20T23:15:14 Last Updated: 2024-08-04T08:22:09.077Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: ua-parser Products: uap-core Problem Types: CWE-20 Description: uap-core before 0.7.3 is vulnerable to a denial of service attack when processing crafted User-Agent strings. Some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This has been patched in uap-core 0.7.3. Additional Analyst Notes: - CVE Program C
to maliciously crafted long strings. This has been patched in uap-core 0.7.3. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ua-parser/uap-core/security/advisories/GHSA-cmcx-xhr8-3w9p - https://github.com/ua-parser/uap-core/commit/0afd61ed85396a3b5316f18bfd1edfaadf8e88e1
CVE ID: CVE-2020-5244 State: PUBLISHED Published: 2020-02-24T17:25:15 Last Updated: 2024-08-04T08:22:09.059Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: buddypress Products: BuddyPress Problem Types: CWE-284 Description: In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed. This has been patched in version 5.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/buddypress/BuddyPress/security/advisories/GHSA-3j78-7m59-r7gv - https://buddypress.org/2020/01/buddypress-5-1-2/ - https://github.com/buddypress/BuddyPress/commit/39294680369
59-r7gv - https://buddypress.org/2020/01/buddypress-5-1-2/ - https://github.com/buddypress/BuddyPress/commit/39294680369a0c992290577a9d740f4a2f2c2ca3
CVE ID: CVE-2020-5245 State: PUBLISHED Published: 2020-02-24T17:35:20 Last Updated: 2024-08-04T08:22:09.091Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: dropwizard Products: dropwizard-validation Problem Types: CWE-74 Description: Dropwizard-Validation before 1.3.19, and 2.0.2 may allow arbitrary code execution on the host system, with the privileges of the Dropwizard service account, by injecting arbitrary Java Expression Language expressions when using the self-validating feature. The issue has been fixed in dropwizard-validation 1.3.19 and 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com
and 2.0.2. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/dropwizard/dropwizard/security/advisories/GHSA-3mcp-9wr4-cjqf - https://github.com/dropwizard/dropwizard/pull/3157 - https://github.com/dropwizard/dropwizard/pull/3160 - https://github.com/dropwizard/dropwizard/commit/28479f743a9d0aab6d0e963fc07f3dd98e8c8236 - https://github.com/dropwizard/dropwizard/commit/d87d1e4f8e20f6494c0232bf8560c961b46db634 - https://beanvalidation.org/2.0/spec/#validationapi-message-defaultmessageinterpolation - https://docs.jboss.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions - https://docs.
.org/hibernate/validator/6.1/reference/en-US/html_single/#section-interpolation-with-message-expressions - https://docs.oracle.com/javaee/7/tutorial/jsf-el.htm
CVE ID: CVE-2020-5246 State: PUBLISHED Published: 2020-07-14T20:42:10 Last Updated: 2024-08-04T08:22:09.089Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N) Vendors: Traccar Products: Traccar Problem Types: CWE-90 Description: Traccar GPS Tracking System before version 4.9 has a LDAP injection vulnerability. It occurs when user input is being used in LDAP search filter. By providing specially crafted input, an attacker can modify the logic of the LDAP query and get admin privileges. The issue only impacts instances with LDAP configuration and where users can craft their own names. This has been patched in version 4.9. Additional Analyst Notes: - CVE Program Container:
ers can craft their own names. This has been patched in version 4.9. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/traccar/traccar/security/advisories/GHSA-v955-7g22-2p49 - https://github.com/traccar/traccar/commit/e4f6e74e57ab743b65d49ae00f6624a20ca0291e
CVE ID: CVE-2020-5247 State: PUBLISHED Published: 2020-02-28T16:55:15 Last Updated: 2024-08-04T08:22:09.079Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: puma Products: Puma Problem Types: CWE-113 Description: In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application using Puma allows untrusted input in a response header, an attacker can use newline characters (i.e. `CR`, `LF` or`/r`, `/n`) to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such
HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2019-16254, which fixed this vulnerability for the WEBrick Ruby web server. This has been fixed in versions 4.3.2 and 3.12.3 by checking all headers for line endings and rejecting headers with those characters. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v - https://owasp.org/www-community/attacks/HTTP_Response_Splitting - https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254 - https://lists.fe
ting - https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/ - https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html
CVE ID: CVE-2020-5248 State: PUBLISHED Published: 2020-05-12T16:05:17 Last Updated: 2024-08-04T08:22:09.092Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-798 Description: GLPI before before version 9.4.6 has a vulnerability involving a default encryption key. GLPIKEY is public and is used on every instance. This means anyone can decrypt sensitive data stored using this key. It is possible to change the key before installing GLPI. But on existing instances, data must be reencrypted with the new key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing
key. Problem is we can not know which columns or rows in the database are using that; espcially from plugins. Changing the key without updating data would lend in bad password sent from glpi; but storing them again from the UI will work. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-j222-j9mf-h6j9 - https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c
CVE ID: CVE-2020-5249 State: PUBLISHED Published: 2020-03-02T15:20:21 Last Updated: 2024-08-04T08:22:09.092Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: puma Products: Puma Problem Types: CWE-113 Description: In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Puma allows untrusted input in an early-hints header, an attacker can use a carriage return character to end the header and inject malicious content, such as additional headers or an entirely new response body. This vulnerability is known as HTTP Response Splitting. While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (
While not an attack in itself, response splitting is a vector for several other attacks, such as cross-site scripting (XSS). This is related to CVE-2020-5247, which fixed this vulnerability but only for regular responses. This has been fixed in 4.3.3 and 3.12.4. Additional Analyst Notes: - CVE Program Container: References: - https://owasp.org/www-community/attacks/HTTP_Response_Splitting - https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58 - https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v - https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject
c93284a45a93f9ad7023888f3a65524f3 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJ3LL5F5QADB6LM46GXZETREAKZMQNRD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BMJ3CGZ3DLBJ5WUUKMI5ZFXFJQMXJZIK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIHVO3CQMU7BZC7FCTSRJ33YDNS3GFPK/
CVE ID: CVE-2020-5250 State: PUBLISHED Published: 2020-03-05T17:00:18 Last Updated: 2024-08-04T08:22:09.084Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: PrestaShop Products: PrestaShop Problem Types: CWE-285 Description: In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/adv
. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mhfc-6rhg-fxp3 - https://github.com/PrestaShop/PrestaShop/commit/a4a609b5064661f0b47ab5bc538e1a9cd3dd1069
CVE ID: CVE-2020-5251 State: PUBLISHED Published: 2020-03-04T15:10:14 Last Updated: 2024-08-04T08:22:09.080Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: parse-community Products: parse-server Problem Types: CWE-285 Description: In parser-server before version 4.1.0, you can fetch all the users objects, by using regex in the NoSQL query. Using the NoSQL, you can use a regex on sessionToken and find valid accounts this way. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-h4mf-75hf-67w4 - https://github.com/parse-community/parse-server/commit/3a3a5eee5ffa48da1352423312cb
ity/advisories/GHSA-h4mf-75hf-67w4 - https://github.com/parse-community/parse-server/commit/3a3a5eee5ffa48da1352423312cb767de14de269
CVE ID: CVE-2020-5252 State: PUBLISHED Published: 2020-03-23T23:05:16 Last Updated: 2024-08-04T08:22:09.086Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:N) Vendors: pyupio Products: safety Problem Types: CWE-807 Description: The command-line "safety" package for Python has a potential security issue. There are two Python characteristics that allow malicious code to “poison-pill” command-line Safety package detection routines by disguising, or obfuscating, other malicious or non-secure packages. This vulnerability is considered to be of low severity because the attack makes use of an existing Python condition, not the Safety tool itself. This can happen if: You are run
ecause the attack makes use of an existing Python condition, not the Safety tool itself. This can happen if: You are running Safety in a Python environment that you don’t trust. You are running Safety from the same Python environment where you have your dependencies installed. Dependency packages are being installed arbitrarily or without proper verification. Users can mitigate this issue by doing any of the following: Perform a static analysis by installing Docker and running the Safety Docker image: $ docker run --rm -it pyupio/safety check -r requirements.txt Run Safety against a static dependencies list, such as the requirements.txt file, in a separate, clean Python environment. Run Safe
against a static dependencies list, such as the requirements.txt file, in a separate, clean Python environment. Run Safety from a Continuous Integration pipeline. Use PyUp.io, which runs Safety in a controlled environment and checks Python for dependencies without any need to install them. Use PyUp's Online Requirements Checker. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pyupio/safety/security/advisories/GHSA-7q25-qrjw-6fg2 - https://pyup.io/posts/patched-vulnerability/ - https://github.com/akoumjian/python-safety-vuln
CVE ID: CVE-2020-5253 State: PUBLISHED Published: 2020-03-10T16:35:14 Last Updated: 2024-08-04T08:22:09.098Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: NetHack Products: NetHack Problem Types: CWE-184 Description: NetHack before version 3.6.0 allowed malicious use of escaping of characters in the configuration file (usually .nethackrc) which could be exploited. This bug is patched in NetHack 3.6.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/NetHack/security/advisories/GHSA-2c7p-3fj4-223m - https://github.com/NetHack/NetHack/commits/612755bfb5c412079795c68ba392df5d93874ed8
CVE ID: CVE-2020-5254 State: PUBLISHED Published: 2020-03-10T16:45:14 Last Updated: 2024-08-04T08:22:09.084Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: NetHack Products: NetHack Problem Types: CWE-125 Description: In NetHack before 3.6.6, some out-of-bound values for the hilite_status option can be exploited. NetHack 3.6.6 resolves this issue. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/NetHack/NetHack/security/advisories/GHSA-2ch6-6r8h-m2p9
CVE ID: CVE-2020-5255 State: PUBLISHED Published: 2020-03-30T19:30:15 Last Updated: 2024-08-04T08:22:09.086Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: symfony Products: symfony Problem Types: CWE-435 Description: In Symfony before versions 4.4.7 and 5.0.7, when a `Response` does not contain a `Content-Type` header, affected versions of Symfony can fallback to the format defined in the `Accept` header of the request, leading to a possible mismatch between the response&#39;s content and `Content-Type` header. When the response is cached, this can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7. Additional Ana
his can prevent the use of the website by other users. This has been patched in versions 4.4.7 and 5.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/symfony/symfony/security/advisories/GHSA-mcx4-f5f5-4859 - https://github.com/symfony/symfony/commit/dca343442e6a954f96a2609e7b4e9c21ed6d74e6 - https://symfony.com/blog/cve-2020-5255-prevent-cache-poisoning-via-a-response-content-type-header - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C36JLPHUPKDFAX6D5WYFC4ALO2K7RDUQ/
CVE ID: CVE-2020-5256 State: PUBLISHED Published: 2020-03-09T15:50:22 Last Updated: 2024-08-04T08:22:09.083Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: BookStackApp Products: BookStack Problem Types: CWE-95 Description: BookStack before version 0.25.5 has a vulnerability where a user could upload PHP files through image upload functions, which would allow them to execute code on the host system remotely. They would then have the permissions of the PHP process. This most impacts scenarios where non-trusted users are given permission to upload images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 an
load images in any area of the application. The issue was addressed in a series of patches in versions 0.25.3, 0.25.4 and 0.25.5. Users should upgrade to at least v0.25.5 to avoid this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BookStackApp/BookStack/security/advisories/GHSA-g9rq-x4fj-f5hx - https://github.com/BookStackApp/BookStack/releases/tag/v0.25.3 - https://github.com/BookStackApp/BookStack/releases/tag/v0.25.4 - https://github.com/BookStackApp/BookStack/releases/tag/v0.25.5