Information from GROWI, Inc.
Vulnerability ID:JVN#51223238
Title:Multiple vulnerabilities in GROWI
Status:Vulnerable
This is a statement from the vendor itself with no modification by JPCERT/CC.
GROWI provided by GROWI, Inc. contains multiple vulnerabilities.
- Authorization bypass through user-controlled key in the page view and comment features (CWE-639)
- Affected: GROWI v3.3.0 through v8.0.6
- https://github.com/growilabs/growi/security/advisories/GHSA-m72c-xgjf-56ww
- Authorization bypass through user-controlled key in the tag update API and the page update API (CWE-639)
- Affected: GROWI v4.5.5 through v8.0.6
- https://github.com/growilabs/growi/security/advisories/GHSA-pqx5-gx68-83h4
- Missing authorization in the collaborative editing feature (CWE-862)
- Affected: GROWI v7.0.0 through v8.0.6
- https://github.com/growilabs/growi/security/advisories/GHSA-3v2v-8q3r-mhm4
These vulnerabilities are fixed in GROWI v8.0.7. Please update to v8.0.7 or later.