SB2019070920 - Multiple vulnerabilities in WESEEK, GROWI
Published: July 9, 2019 Updated: August 8, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Improper Authentication (CVE-ID: CVE-2019-13337)
The vulnerability allows a remote non-authenticated attacker to manipulate data.
In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.
2) Information disclosure (CVE-ID: CVE-2019-13338)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
In WESEEK GROWI before 3.5.0, a remote attacker can obtain the password hash of the creator of a page by leveraging wiki access to make API calls for page metadata. In other words, the password hash can be retrieved even though it is not a publicly available field.
Remediation
Install update from vendor's website.