bookstack is vulnerable to Improper Access Control

GHSA ID

GHSA-ghhm-xrwp-75m9

CVE ID

CVE-2021-4194

Severity

medium

Published

2022-01-08T00:34:12Z

Updated

2023-01-27T05:02:47Z

CVSS

4.3 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS v3

4.3 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

CWEs

• CWE-284 · Improper Access Control
• CWE-668 · Exposure of Resource to Wrong Sphere
• CWE-863 · Incorrect Authorization

References

• https://nvd.nist.gov/vuln/detail/CVE-2021-4194 ↗
• https://github.com/bookstackapp/bookstack/commit/cb0d674a71449de883713db2fcdccb6e108992ad ↗
• https://huntr.dev/bounties/0bc8b3f7-9057-4eb7-a989-24cd5689f114 ↗
• https://github.com/advisories/GHSA-ghhm-xrwp-75m9 ↗