SB2023121534 - Multiple vulnerabilities in GROWI

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Authorization (CVE-ID: CVE-2023-50332)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper authorization in the User Management (/admin/users) page. A remote attacker can delete or suspend its own account without the user's intention.

2) Cleartext storage of sensitive information (CVE-ID: CVE-2023-50294)

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to cleartext storage of sensitive information in the App Settings (/admin/app) page's Secret access key. A remote administrator can obtain the Secret access key for external service.

Remediation

Install update from vendor's website.

References

• https://jvn.jp/en/jp/JVN18715935/index.html
• https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/