GitHub Advisoryadvisory · Packagist

GHSA-9c5c-5j4h-8q2c BookStack is vulnerable to Improper Access Control.

MEDIUM Published 2021-12-16 Modified 2022-08-11 Official page ↗
Aliases
CVE-2021-4119
Ecosystem
Packagist
Packages
ssddanbrown/bookstack
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-284
Reviewed
2021-12-16

Affected packages

• Packagist ssddanbrown/bookstack: < 21.11.3 → fixed in 21.11.3

Description

BookStack prior to version 21.11.3 is vulnerable to Improper Access Control. A logged-in user with no privileges OR guest user (if public access enabled) can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database. This can also be used to harvest email belonging to a user because BookStack also uses the code where(`email`, `like`, `%` . $search . `%`) to search for users based on email.

Related

Alias · CVE (1)

  • CVE-2021-4119 bookstack is vulnerable to Improper Access Control vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References