CVE-2022-24837
Assigner: GitHub_M
Published: 2022-04-11T20:20:26
State: PUBLISHED
affected: product: hedgedoc
vendor: hedgedoc
versions: status: affected
version: >=1.9.1, < 1.9.3
descriptions: value: HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes and affects all upload backends, except Lutim and imgur. This issue is patched in version 1.9.3 by replacing the filename generation with UUIDv4. If you cannot upgrade to HedgeDoc 1.9.3, it is possible to block POST requests to `/uploadimage`, which will disable future uploads.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
source: advisory: GHSA-q6vv-2q26-j7rx
discovery: UNKNOWN
title: Enumerable upload file names in hedgedoc