CVE-2022-41799: Medium severity WESEEK GROWI vulnerability
Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 5.1.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.5.25
Event History
Frequently Asked Questions
What is the severity of CVE-2022-41799?
CVE-2022-41799 is classified as a high severity vulnerability due to its potential to allow unauthorized access to private markdown data.
How do I fix CVE-2022-41799?
To mitigate CVE-2022-41799, users should upgrade GROWI to versions 5.1.4 or later for the v5 series or 4.5.25 or later for the v4 series.
Who is affected by CVE-2022-41799?
CVE-2022-41799 affects GROWI versions prior to 5.1.4 and 4.5.25, allowing remote authenticated attackers to bypass access controls.
What type of vulnerability is CVE-2022-41799?
CVE-2022-41799 is an improper access control vulnerability that enables unauthorized viewing of private content.
What can an attacker exploit in CVE-2022-41799?
An attacker can exploit CVE-2022-41799 to bypass access restrictions and download markdown data from private pages.