Lnielsen

Name of the Vulnerable Software and Affected Versions: Invenio-Drafts-Resources versions prior to 0.13.7 and 0.14.6 Description: Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. The issue arises from improper permission checks when a record is published, making it exploitable in a default installation of InvenioRDM. An authenticated user can publish draft records of other users via REST API calls if they know the record identifier and the draft validates. However, the attacker cannot modify the data in the record, such as changing a record from restricted to public. Recommendations: For Invenio-Drafts-Resources versions prior to 0.13.7, update to version 0.13.7 or later. For Invenio-Drafts-Resources versions prior to 0.14.6, update to version 0.14.6 or later. As a temporary workaround, consider restricting access to the REST API endpoints related to publishing draft records until a patch is applied.

Name of the Vulnerable Software and Affected Versions: Invenio-App versions prior to 1.1.1 Description: A host header injection attack has been identified in Invenio-App. This issue can be exploited if the web server is configured to route all requests to the application, the `APP ALLOWED HOSTS` configuration variable is relied upon to whitelist allowed host headers, and Flask's `request.host` is not evaluated during request handling. This can occur in views that do not evaluate `request.host`, such as those using `url for` to generate external URLs. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. Recommendations: For Invenio-App versions prior to 1.1.1, upgrade to version 1.1.1 or later to fully fix the issue. As a temporary workaround, configure your web server to ensure that it never routes requests with a wrong host header to your application. This can be achieved by defining two virtual hosts: a default virtual host that acts as a catch-all and an application virtual host that is configured to only reply to a whitelist of host headers. Alternatively, include the following code snippet in your application to force evaluation of `request.host`: ```python @app.before request def before request(): request.host ```

Name of the Vulnerable Software and Affected Versions: invenio-previewer versions prior to 1.0.0a12 Description: A Cross-Site Scripting (XSS) issue has been found in the JSON, Markdown, and iPython Notebook previewers. This would allow a malicious user to upload a file with embedded scripts that would be executed by a victim's browser. Recommendations: For versions prior to 1.0.0a12, update to version 1.0.0a12 to fix the issue. As a temporary workaround, consider disabling the affected previewers by modifying the configuration to exclude 'json prismjs', 'mistune', and 'ipynb' from PREVIEWER PREFERENCE.