CVE-2025-66629: falha de baixa gravidade em hedgedoc
HedgeDoc is missing state parameter in OAuth2 flows could lead to CSRF
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.7epss 0.1%
HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.4, some of HedgeDoc's OAuth2 endpoints for social login providers such as Google, GitHub, GitLab, Facebook or Dropbox lack CSRF protection, since they don't send a state parameter and verify the response using this parameter. This vulnerability is fixed in 1.10.4.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Produtos afetados
hedgedoc · hedgedocCVEs relacionadas — hedgedoc
No mesmo produto, das mais perigosas para as menos.
CVE-2021-29474MEDIUMRelative Path Traversal Attack on note creationEPSS 1.6%CVE-2020-26287HIGHStored XSS in mermaid diagramsEPSS 1.5%CVE-2020-26286HIGHArbitary file uploadEPSS 1.4%CVE-2021-21259HIGHStored XSS in slide modeEPSS 1.4%CVE-2021-29475CRITICALPDF export allows arbitrary file readsEPSS 1.2%CVE-2022-24837MEDIUMEnumerable upload file names in hedgedocEPSS 1.1%