CVE-2023-50294: Medium severity growi vulnerability
The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50294?
CVE-2023-50294 is considered a high-severity vulnerability due to the potential exposure of sensitive information.
How do I fix CVE-2023-50294?
To fix CVE-2023-50294, upgrade GROWI to version 6.0.6 or later to ensure sensitive information is no longer stored in cleartext.
What information is compromised in CVE-2023-50294?
CVE-2023-50294 can lead to the exposure of the Secret access key for external services stored in cleartext.
Who is affected by CVE-2023-50294?
Users of GROWI versions prior to 6.0.6 are affected by CVE-2023-50294.
Can CVE-2023-50294 be exploited remotely?
Yes, CVE-2023-50294 can be exploited remotely by an attacker who gains access to the App Settings page.