deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-29805
Published: 2021-07-12
Description: IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204263.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204263; https://www.ibm.com/support/pages/node/6471067; https://exchange.xforce.ibmcloud.com/vulnerabilities/204263
CVE: CVE-2021-29822
Published: 2021-07-12
Description: IBM Tivoli Netcool/OMNIbus_GUI 8.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 204349.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/204349; https://www.ibm.com/support/pages/node/6471067; https://exchange.xforce.ibmcloud.com/vulnerabilities/204349
CVE: CVE-2021-32703
Published: 2021-07-12
Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the shareinfo endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-799, CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-375p-cxxq-gc9p; https://github.com/nextcloud/server/pull/26945; https://hackerone.com/reports/1173684
CVE: CVE-2021-32705
Published: 2021-07-12
Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public DAV endpoint. This may have allowed an attacker to enumerate potentially valid share tokens or credentials. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-799, CWE-307
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fjv7-283f-5m54; https://github.com/nextcloud/server/pull/27610; https://hackerone.com/reports/1192159
CVE: CVE-2021-36381
Published: 2021-07-12
Description: In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?logon_error= on the login screen of the Web application.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-74
References: https://gist.github.com/rvismit/c2da674254f53c40d3a9eb3896277ebc; https://www.edifecs.com/services/managed-services/; https://gist.github.com/rvismit/c2da674254f53c40d3a9eb3896277ebc
CVE: CVE-2020-18982
Published: 2021-07-12
Description: Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/halo-dev/halo/issues/127; https://github.com/halo-dev/halo/issues/127
CVE: CVE-2020-19037
Published: 2021-07-12
Description: Incorrect Access Control vulnearbility in Halo 0.4.3, which allows a malicious user to bypass encrption to view encrpted articles via cookies.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-287
References: https://github.com/halo-dev/halo/issues/135; https://github.com/halo-dev/halo/issues/135
CVE: CVE-2020-19038
Published: 2021-07-12
Description: File Deletion vulnerability in Halo 0.4.3 via delBackup.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862
References: https://cwe.mitre.org/data/definitions/23.html; https://github.com/halo-dev/halo/issues/136; https://cwe.mitre.org/data/definitions/23.html
CVE: CVE-2020-23079
Published: 2021-07-12
Description: SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://github.com/halo-dev/halo/issues/806; https://github.com/halo-dev/halo/issues/806
CVE: CVE-2021-32689
Published: 2021-07-12
Description: Nextcloud Talk is a fully on-premises audio/video and chat communication service. In versions prior to 11.2.2, if a user was able to reuse an earlier used username, they could get access to any chat message sent to the previous user with this username. The issue was patched in versions 11.2.2 and 11.3.0. As a workaround, don't allow users to choose usernames themselves. This is the default behaviour of Nextcloud, but some user providers may allow doing so.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200, CWE-708
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xv6f-344w-895c; https://github.com/nextcloud/spreed/pull/5633; https://github.com/nextcloud/spreed/releases/tag/v11.2.2
CVE: CVE-2021-32707
Published: 2021-07-12
Description: Nextcloud Mail is a mail app for Nextcloud. In versions prior to 1.9.6, the Nextcloud Mail application does not, by default, render images in emails to not leak the read state. The privacy filter failed to filter images with a `background-image` CSS attribute. Note that the images were still passed through the Nextcloud image proxy, and thus there was no IP leakage. The issue was patched in version 1.9.6 and 1.10.0. No workarounds are known to exist.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-20, CWE-200
References: https://github.com/nextcloud/mail/pull/5189; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xxp4-44xc-8crh; https://hackerone.com/reports/1215251
CVE: CVE-2020-18544
Published: 2021-07-12
Description: SQL Injection in WMS v1.0 allows remote attackers to execute arbitrary code via the "username" parameter in the component "chkuser.php".
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/FeMiner/wms/issues/5; https://github.com/FeMiner/wms/issues/5
CVE: CVE-2020-19907
Published: 2021-07-12
Description: A command injection vulnerability in the sandcat plugin of Caldera 2.3.1 and earlier allows authenticated attackers to execute any command or service.
CVSS Score: 8.8 (HIGH)
CWE: CWE-78
References: https://cwe.mitre.org/data/definitions/78.html; https://github.com/mitre/caldera/issues/462; https://cwe.mitre.org/data/definitions/78.html
CVE: CVE-2021-24365
Published: 2021-07-12
Description: The Admin Columns WordPress plugin Free before 4.3.2 and Pro before 5.5.2 allowed to configure individual columns for tables. Each column had a type. The type "Custom Field" allowed to choose an arbitrary database column to display in the table. There was no escaping applied to the contents of "Custom Field" columns.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/fdbeb137-b404-46c7-85fb-394a3bdac388; https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-032.txt; https://wpscan.com/vulnerability/fdbeb137-b404-46c7-85fb-394a3bdac388
CVE: CVE-2021-24385
Published: 2021-07-12
Description: The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post request. This is a major vulnerability as the user input is not escaped and passed directly to the get_col function and it allows SQL injection. The Rest API endpoint which invokes this function also does not have any required permissions/authentication and can be accessed by an anonymous user.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://10up.com/blog/2021/security-vulnerability-filebird-wordpress-plugin/; https://wpscan.com/vulnerability/754ac750-0262-4f65-b23e-d5523995fbfa; https://10up.com/blog/2021/security-vulnerability-filebird-wordpress-plugin/
CVE: CVE-2021-24408
Published: 2021-07-12
Description: The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters, allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/51855853-e7bd-425f-802c-824209f4f84d; https://wpscan.com/vulnerability/51855853-e7bd-425f-802c-824209f4f84d
CVE: CVE-2021-24409
Published: 2021-07-12
Description: The Prismatic WordPress plugin before 2.8 does not escape the 'tab' GET parameter before outputting it back in an attribute, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ae3cd3ed-aecd-4d8c-8a2b-2936aaaef0cf; https://wpscan.com/vulnerability/ae3cd3ed-aecd-4d8c-8a2b-2936aaaef0cf
CVE: CVE-2021-24418
Published: 2021-07-12
Description: The Smooth Scroll Page Up/Down Buttons WordPress plugin through 1.4 does not properly sanitise and validate its psb_positioning settings, allowing high privilege users such as admin to set an XSS payload in it, which will be executed in all pages of the blog
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-04-29%5D-%5BWordPress%5D-%5BCWE-79%5D-Smooth-Scroll-Page-UpDown-Buttons-WordPress-Plugin-v1.4.txt; https://wpscan.com/vulnerability/1512bba9-89e2-493d-b85d-10c7acb903db; https://m0ze.ru/vulnerability/%5B2021-04-29%5D-%5BWordPress%5D-%5BCWE-79%5D-Smooth-Scroll-Page-UpDown-Buttons-WordPress-Plugin-v1.4.txt
CVE: CVE-2021-24419
Published: 2021-07-12
Description: The WP YouTube Lyte WordPress plugin before 1.7.16 did not sanitise or escape its lyte_yt_api_key and lyte_notification settings before outputting them back in the page, allowing high privilege users to set XSS payload on them and leading to stored Cross-Site Scripting issues.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-05-03%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-YouTube-Lyte-WordPress-Plugin-v1.7.15.txt; https://wpscan.com/vulnerability/0eeff1ee-d11e-4d52-a032-5f5bd8a6a2d7; https://m0ze.ru/vulnerability/%5B2021-05-03%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-YouTube-Lyte-WordPress-Plugin-v1.7.15.txt
CVE: CVE-2021-24420
Published: 2021-07-12
Description: The Request a Quote WordPress plugin before 2.3.4 did not sanitise and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the 'All Quotes" table.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/426eafb1-0261-4e7e-8c70-75bf4c476f18; https://wpscan.com/vulnerability/426eafb1-0261-4e7e-8c70-75bf4c476f18
CVE: CVE-2021-24421
Published: 2021-07-12
Description: The WP JobSearch WordPress plugin before 1.7.4 did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page, allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issue
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-05-19%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-JobSearch-WordPress-Plugin-v1.7.3.txt; https://wpscan.com/vulnerability/b378d36d-66d9-4373-a628-e379e4766375; https://m0ze.ru/vulnerability/%5B2021-05-19%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-JobSearch-WordPress-Plugin-v1.7.3.txt
CVE: CVE-2021-24424
Published: 2021-07-12
Description: The WP Reset – Most Advanced WordPress Reset Tool WordPress plugin before 1.90 did not sanitise or escape its extra_data parameter when creating a snapshot via the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-05-26%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Reset-WordPress-Plugin-v1.86.txt; https://wpscan.com/vulnerability/90cf8f9d-4d37-405d-b161-239bdb281828; https://m0ze.ru/vulnerability/%5B2021-05-26%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Reset-WordPress-Plugin-v1.86.txt
CVE: CVE-2021-24426
Published: 2021-07-12
Description: The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-05-23%5D-%5BWordPress%5D-%5BCWE-79%5D-Backup-by-10Web-WordPress-Plugin-v1.0.20.txt; https://wpscan.com/vulnerability/48464b3f-fe57-40fe-8868-398a36099fb9; https://m0ze.ru/vulnerability/%5B2021-05-23%5D-%5BWordPress%5D-%5BCWE-79%5D-Backup-by-10Web-WordPress-Plugin-v1.0.20.txt
CVE: CVE-2021-24427
Published: 2021-07-12
Description: The W3 Total Cache WordPress plugin before 2.1.3 did not sanitise or escape some of its CDN settings, allowing high privilege users to use JavaScript in them, which will be output in the page, leading to an authenticated Stored Cross-Site Scripting issue
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://m0ze.ru/vulnerability/%5B2021-04-25%5D-%5BWordPress%5D-%5BCWE-79%5D-W3-Total-Cache-WordPress-Plugin-v2.1.2.txt; https://wpscan.com/vulnerability/5da5ce9a-82a6-404f-8dec-795d7905b3f9; https://m0ze.ru/vulnerability/%5B2021-04-25%5D-%5BWordPress%5D-%5BCWE-79%5D-W3-Total-Cache-WordPress-Plugin-v2.1.2.txt
CVE: CVE-2021-24429
Published: 2021-07-12
Description: The Salon booking system WordPress plugin before 6.3.1 does not properly sanitise and escape the First Name field when booking an appointment, allowing low privilege users such as subscriber to set JavaScript in them, leading to a Stored Cross-Site Scripting (XSS) vulnerability. The Payload will then be triggered when an admin visits the "Calendar" page and the malicious script is executed in the admin context.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/e922b788-7da5-43b4-9b05-839c8610252a; https://wpscan.com/vulnerability/e922b788-7da5-43b4-9b05-839c8610252a
CVE: CVE-2021-24434
Published: 2021-07-12
Description: The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-352, CWE-79, CWE-352
References: https://wpscan.com/vulnerability/dbea2dc2-83f6-4e70-b044-a68a4c9b9c39; https://wpscan.com/vulnerability/dbea2dc2-83f6-4e70-b044-a68a4c9b9c39
CVE: CVE-2021-24439
Published: 2021-07-12
Description: The Browser Screenshots WordPress plugin before 1.7.6 allowed authenticated users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks as the image_class parameter of the browser-shot shortcode was not escaped.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/9c538c51-ae58-461d-b93b-cc9dfebf2bc0; https://wpscan.com/vulnerability/9c538c51-ae58-461d-b93b-cc9dfebf2bc0
CVE: CVE-2021-24440
Published: 2021-07-12
Description: The Sign-up Sheets WordPress plugin before 1.0.14 did not sanitise or escape some of its fields when creating a new sheet, allowing high privilege users to add JavaScript in them, leading to a Stored Cross-Site Scripting issue. The payloads will be triggered when viewing the 'All Sheets' page in the admin dashboard
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/ba4503f7-684e-4274-bc53-3aa848712496; https://wpscan.com/vulnerability/ba4503f7-684e-4274-bc53-3aa848712496
CVE: CVE-2021-24441
Published: 2021-07-12
Description: The Sign-up Sheets WordPress plugin before 1.0.14 does not not sanitise or validate the Sheet title when generating the CSV to export, which could lead to a CSV injection issue
CVSS Score: 8.0 (HIGH)
CWE: CWE-1236
References: https://wpscan.com/vulnerability/ec9292b1-5cbd-4332-bdb6-2351c94f5ac6; https://wpscan.com/vulnerability/ec9292b1-5cbd-4332-bdb6-2351c94f5ac6
CVE: CVE-2021-24442
Published: 2021-07-12
Description: The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the date_answers[] POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://wpscan.com/vulnerability/7376666e-9b2a-4239-b11f-8544435b444a; https://www.in-spired.xyz/wpdevart-polls-blind-sql-injection/; https://wpscan.com/vulnerability/7376666e-9b2a-4239-b11f-8544435b444a
CVE: CVE-2021-24454
Published: 2021-07-12
Description: In the YOP Poll WordPress plugin before 6.2.8, when a pool is created with the options "Allow other answers", "Display other answers in the result list" and "Show results", it can lead to Stored Cross-Site Scripting issues as the 'Other' answer is not sanitised before being output in the page. The execution of the XSS payload depends on the 'Show results' option selected, which could be before or after sending the vote for example.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/48ade7a5-5abb-4267-b9b6-13e31e1b3e91; https://www.in-spired.xyz/discovering-wordpress-plugin-yop-polls-v6-2-7-stored-xss/; https://wpscan.com/vulnerability/48ade7a5-5abb-4267-b9b6-13e31e1b3e91
CVE: CVE-2021-32725
Published: 2021-07-12
Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissions were not being respected for federated reshares of files and folders. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
CVSS Score: 3.5 (LOW)
CWE: CWE-277, CWE-276
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6f6v-h9x9-jj4v; https://github.com/nextcloud/server/pull/26946; https://hackerone.com/reports/1178320
CVE: CVE-2021-32726
Published: 2021-07-12
Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were not deleted after a user has been deleted. If a victim reused an earlier used username, the previous user could gain access to their account. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
CVSS Score: 7.1 (HIGH)
CWE: CWE-708, CWE-287
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6qr9-c846-j8mg; https://github.com/nextcloud/server/pull/27532; https://hackerone.com/reports/1202590
CVE: CVE-2021-32727
Published: 2021-07-12
Description: Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public and private key via an API endpoint. In versions prior to 3.16.1, the Nextcloud Android client skipped a step that involved the client checking if a private key belonged to a previously downloaded public certificate. If the Nextcloud instance served a malicious public key, the data would be encrypted for this key and thus could be accessible to a malicious actor. The vulnerability is patched in version 3.16.1. As a workaround, do not add additional end-to-end encrypted devices to a user account.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-295, CWE-295
References: https://github.com/nextcloud/android/pull/8438; https://github.com/nextcloud/end_to_end_encryption_rfc/blob/7f002996397faefb664019a97ebb0a1e210f64f0/RFC.md#further-devices; https://github.com/nextcloud/security-advisories/security/advisories/GHSA-5v33-r9cm-7736
CVE: CVE-2021-32733
Published: 2021-07-12
Description: Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versions prior to 19.0.13, 20.0.11, and 21.0.3. The Nextcloud Text application shipped with Nextcloud server used a `text/html` Content-Type when serving files to users. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, use a browser that has support for Content-Security-Policy.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-x4w3-jhcr-57pq; https://github.com/nextcloud/text/pull/1689; https://hackerone.com/reports/1241460
CVE: CVE-2021-32734
Published: 2021-07-12
Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, the Nextcloud Text application shipped with Nextcloud Server returned verbatim exception messages to the user. This could result in a full path disclosure on shared files. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. As a workaround, one may disable the Nextcloud Text application in Nextcloud Server app settings.
CVSS Score: 3.1 (LOW)
CWE: CWE-209, CWE-209
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-6hf5-c2c4-2526; https://github.com/nextcloud/text/pull/1695; https://hackerone.com/reports/1246721
CVE: CVE-2021-32741
Published: 2021-07-12
Description: Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, there was a lack of ratelimiting on the public share link mount endpoint. This may have allowed an attacker to enumerate potentially valid share tokens. The issue was fixed in versions 19.0.13, 20.0.11, and 21.0.3. There are no known workarounds.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-799
References: https://github.com/nextcloud/security-advisories/security/advisories/GHSA-crvj-vmf7-xrvr; https://github.com/nextcloud/server/pull/26958; https://hackerone.com/reports/1192144
CVE: CVE-2021-32746
Published: 2021-07-12
Description: Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Between versions 2.3.0 and 2.8.2, the `doc` module of Icinga Web 2 allows to view documentation directly in the UI. It must be enabled manually by an administrator and users need explicit access permission to use it. Then, by visiting a certain route, it is possible to gain access to arbitrary files readable by the web-server user. The issue has been fixed in the 2.9.0, 2.8.3, and 2.7.5 releases. As a workaround, an administrator may disable the `doc` module or revoke permission to use it from all users.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22, CWE-22
References: https://github.com/Icinga/icingaweb2/releases/tag/v2.7.5; https://github.com/Icinga/icingaweb2/releases/tag/v2.8.3; https://github.com/Icinga/icingaweb2/releases/tag/v2.9.0