Norihide Saito

A stored cross-site scripting issue exists in the User Management page (/admin/users) of GROWI. This issue can lead to the execution of an arbitrary script on the web browser of the user who accessed the site using the product.

A cross-site request forgery (CSRF) issue exists in the User settings (/me) page. If a user views a malicious page while logged in, settings may be changed without the user's intention. The API endpoint `/me` is affected.

A stored cross-site scripting issue exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page. This could allow an arbitrary script to be executed on the web browser of the user who accessed the site using the product.

The issue concerns the storage of sensitive information in cleartext form on the App Settings page, located at "/admin/app". This could allow an attacker with access to the page to obtain the Secret access key for an external service.

An improper authorization issue exists in the User Management page, specifically at the `/admin/users` endpoint. This issue can lead to unintended deletion or suspension of a user's account.

The issue is caused by improper input validation, allowing remote attackers to cause a denial of service via unspecified vectors.

A reflected cross-site scripting issue allows remote attackers to inject arbitrary script via unspecified vectors.

The issue allows remote attackers to inject arbitrary script via unspecified vectors, which is a stored cross-site scripting vulnerability.

The issue allows remote attackers to obtain information that is not allowed to access via unspecified vectors.