GHSA-3v2v-8q3r-mhm4: Medium severity vulnerability
GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.
Event History
Frequently Asked Questions
Which users can exploit this issue?
Users with read-only permission, including guest users, can modify page drafts. Users whose accounts are pending, suspended, or invited can also do so.
What access does an attacker need?
The issue is exploitable over the network without prior privileges or user interaction. The attacker must be able to access the collaborative editing feature as one of the affected account types.
What content can be changed?
The vulnerability allows unauthorized modification of page drafts. The provided information does not indicate that published pages or other page data can be modified.