CVE-2022-24837mediumCWE-200

CVE-2022-24837: falha de média gravidade em hedgedoc

Enumerable upload file names in hedgedoc

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar hedgedoc

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 1.1%
HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes and affects all upload backends, except Lutim and imgur. This issue is patched in version 1.9.3 by replacing the filename generation with UUIDv4. If you cannot upgrade to HedgeDoc 1.9.3, it is possible to block POST requests to `/uploadimage`, which will disable future uploads.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
hedgedoc · hedgedoc
CVEs relacionadas — hedgedoc

No mesmo produto, das mais perigosas para as menos.

CVE-2021-29474MEDIUMRelative Path Traversal Attack on note creationEPSS 1.6%CVE-2020-26287HIGHStored XSS in mermaid diagramsEPSS 1.5%CVE-2020-26286HIGHArbitary file uploadEPSS 1.4%CVE-2021-21259HIGHStored XSS in slide modeEPSS 1.4%CVE-2021-29475CRITICALPDF export allows arbitrary file readsEPSS 1.2%CVE-2021-29503HIGHImproper Neutralization of Script-Related HTML Tags in NotesEPSS 1.0%