PT-2023-31526
CVE-2023-50294
·
تاريخ النشر
2023-12-26
·
تاريخ التحديث
2024-01-02
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
GROWI versions prior to v6.0.6
Description
The issue concerns the storage of sensitive information in cleartext form on the App Settings page, located at "/admin/app". This could allow an attacker with access to the page to obtain the Secret access key for an external service.
Recommendations
For versions prior to v6.0.6, update to version v6.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the App Settings page (/admin/app) to minimize the risk of exploitation.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾