paperless-ngx's remote user auth via header works even when disabling it for API
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.5epss 0.5%
probabilidad de explotación
0.5%top 60% de las CVE
explotación observada
noninguna fuente lo reporta
Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Productos afectados
paperless-ngx · paperless-ngxReferencias
https://github.com/paperless-ngx/paperless-ngx/commit/ed05b40ba461641b1b59b0a92f51f3f6a66ce180https://github.com/paperless-ngx/paperless-ngx/pull/6739https://github.com/paperless-ngx/paperless-ngx/releases/tag/v2.8.6https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-72w4-hxqq-c256