GitHub Advisoryadvisory · Packagist

GHSA-pj36-fcrg-327j BookStack Incorrect Access Control vulnerability

HIGH Published 2024-07-10 Modified 2024-07-10 Official page ↗

Aliases: CVE-2024-36676
Ecosystem: Packagist
Packages: ssddanbrown/bookstack
Severity: High
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Weaknesses: CWE-284, CWE-79
Reviewed: 2024-07-10

Affected packages

• Packagist ssddanbrown/bookstack: < 24.05.1 → fixed in 24.05.1

Description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

Alias · CVE (1)

CVE-2024-36676 Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification… vulnerability

Weakness · CWE (2)

CWE-284 Improper Access Control weakness
CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2024-36676 advisory
https://github.com/BookStackApp/BookStack/issues/4993 web
https://github.com/BookStackApp/BookStack/commit/69af9e0dbdefd8c6c951e8afbe2bba141d454beb web
https://github.com/BookStackApp/BookStack package
https://github.com/BookStackApp/BookStack/releases/tag/v24.05.1 web
https://www.bookstackapp.com/blog/bookstack-release-v24-05-1 web