Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner

Sources

Sort by

Order

Apply ordering (override relevance)

CVE-2025-54806 (GCVE-0-2025-54806)

Vulnerability from nvd – Published: 2025-10-23 04:10 – Updated: 2025-10-23 15:05

Summary

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.

Severity

6.1 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://growi.co.jp/news/38/
https://jvn.jp/en/jp/JVN46526244/

Impacted products

1 product

Vendor	Product	Version
GROWI, Inc.	GROWI	Affected: v4.2.7 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54806",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-23T15:04:03.231658Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-23T15:05:14.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.2.7 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability  in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user\u0027s web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-23T04:10:59.281Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/38/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN46526244/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-54806",
    "datePublished": "2025-10-23T04:10:59.281Z",
    "dateReserved": "2025-10-15T05:16:42.225Z",
    "dateUpdated": "2025-10-23T15:05:14.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50339 (GCVE-0-2023-50339)

Vulnerability from nvd – Published: 2023-12-26 07:20 – Updated: 2024-09-09 18:00

Summary

Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: v6.1.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:16:46.697Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-50339",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-27T18:02:51.280364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T18:00:25.425Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v6.1.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:31.556Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-50339",
    "datePublished": "2023-12-26T07:20:31.556Z",
    "dateReserved": "2023-12-07T02:39:54.055Z",
    "dateUpdated": "2024-09-09T18:00:25.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50332 (GCVE-0-2023-50332)

Vulnerability from nvd – Published: 2023-12-26 07:21 – Updated: 2024-08-02 22:16

Summary

Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user's intention.

Severity

No CVSS data available.

CWE

Improper authorization

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:16:46.265Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user\u0027s intention.\r\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper authorization",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:24.393Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-50332",
    "datePublished": "2023-12-26T07:21:24.393Z",
    "dateReserved": "2023-12-07T02:39:51.268Z",
    "dateUpdated": "2024-08-02T22:16:46.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50294 (GCVE-0-2023-50294)

Vulnerability from nvd – Published: 2023-12-26 07:21 – Updated: 2024-08-02 22:16

Summary

The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.

Severity

No CVSS data available.

CWE

Cleartext storage of sensitive information

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:16:46.259Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cleartext storage of sensitive information",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:19.831Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-50294",
    "datePublished": "2023-12-26T07:21:19.831Z",
    "dateReserved": "2023-12-07T02:39:43.973Z",
    "dateUpdated": "2024-08-02T22:16:46.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50175 (GCVE-0-2023-50175)

Vulnerability from nvd – Published: 2023-12-26 07:21 – Updated: 2025-04-23 15:59

Summary

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Cross-site scripting (XSS)
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:09:49.793Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-50175",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-02T17:53:10.816140Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T15:59:54.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:15.728Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-50175",
    "datePublished": "2023-12-26T07:21:15.728Z",
    "dateReserved": "2023-12-07T02:39:52.053Z",
    "dateUpdated": "2025-04-23T15:59:54.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-49807 (GCVE-0-2023-49807)

Vulnerability from nvd – Published: 2023-12-26 07:21 – Updated: 2024-08-02 22:01

Summary

Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:01:26.024Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:11.658Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-49807",
    "datePublished": "2023-12-26T07:21:11.658Z",
    "dateReserved": "2023-12-07T02:39:44.808Z",
    "dateUpdated": "2024-08-02T22:01:26.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-49779 (GCVE-0-2023-49779)

Vulnerability from nvd – Published: 2023-12-26 07:21 – Updated: 2024-08-02 22:01

Summary

Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:01:25.681Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:06.972Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-49779",
    "datePublished": "2023-12-26T07:21:06.972Z",
    "dateReserved": "2023-12-07T02:39:53.189Z",
    "dateUpdated": "2024-08-02T22:01:25.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-49598 (GCVE-0-2023-49598)

Vulnerability from nvd – Published: 2023-12-26 07:21 – Updated: 2024-08-02 22:01

Summary

Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:01:25.946Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:02.611Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-49598",
    "datePublished": "2023-12-26T07:21:02.611Z",
    "dateReserved": "2023-12-07T02:39:42.967Z",
    "dateUpdated": "2024-08-02T22:01:25.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-49119 (GCVE-0-2023-49119)

Vulnerability from nvd – Published: 2023-12-26 07:20 – Updated: 2024-11-27 15:22

Summary

Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:46:29.293Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-49119",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-10T20:31:53.312588Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-27T15:22:12.385Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:58.393Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-49119",
    "datePublished": "2023-12-26T07:20:58.393Z",
    "dateReserved": "2023-12-07T02:39:46.701Z",
    "dateUpdated": "2024-11-27T15:22:12.385Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-47215 (GCVE-0-2023-47215)

Vulnerability from nvd – Published: 2023-12-26 07:20 – Updated: 2024-08-02 21:01

Summary

Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:01:22.674Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:53.804Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-47215",
    "datePublished": "2023-12-26T07:20:53.804Z",
    "dateReserved": "2023-12-07T02:39:47.663Z",
    "dateUpdated": "2024-08-02T21:01:22.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-46699 (GCVE-0-2023-46699)

Vulnerability from nvd – Published: 2023-12-26 07:20 – Updated: 2024-09-12 12:36

Summary

Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Cross-site request forgery (CSRF)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:53:20.881Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46699",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-04T18:22:27.439104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T12:36:17.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user\u0027s intention."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:48.092Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-46699",
    "datePublished": "2023-12-26T07:20:48.092Z",
    "dateReserved": "2023-12-07T02:39:49.423Z",
    "dateUpdated": "2024-09-12T12:36:17.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45740 (GCVE-0-2023-45740)

Vulnerability from nvd – Published: 2023-12-26 07:20 – Updated: 2025-04-23 16:03

Summary

Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Cross-site scripting (XSS)
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v4.1.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:29:32.245Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-45740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-02T17:52:27.722596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:03:49.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v4.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:42.853Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-45740",
    "datePublished": "2023-12-26T07:20:42.853Z",
    "dateReserved": "2023-12-07T02:39:50.226Z",
    "dateUpdated": "2025-04-23T16:03:49.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45737 (GCVE-0-2023-45737)

Vulnerability from nvd – Published: 2023-12-26 07:20 – Updated: 2024-08-02 20:29

Summary

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v3.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:29:32.277Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v3.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:36.390Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-45737",
    "datePublished": "2023-12-26T07:20:36.390Z",
    "dateReserved": "2023-12-07T02:39:48.512Z",
    "dateUpdated": "2024-08-02T20:29:32.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-42436 (GCVE-0-2023-42436)

Vulnerability from nvd – Published: 2023-12-26 07:22 – Updated: 2024-08-02 19:16

Summary

Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v3.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:16:51.003Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v3.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:22:50.373Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-42436",
    "datePublished": "2023-12-26T07:22:50.373Z",
    "dateReserved": "2023-12-07T02:39:45.772Z",
    "dateUpdated": "2024-08-02T19:16:51.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-41799 (GCVE-0-2022-41799)

Vulnerability from nvd – Published: 2022-10-24 00:00 – Updated: 2025-05-07 16:12

Summary

Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Improper Access Control
CWE-noinfo Not enough information

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/en/news/2022/10/07/growi-pri…
https://jvn.jp/en/jp/JVN00845253/index.html

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI v5 series and v4 series	Affected: versions prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:56:38.188Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/en/news/2022/10/07/growi-private-page-can-be-viewed/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN00845253/index.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-41799",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T16:11:29.358137Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T16:12:01.378Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI v5 series and v4 series",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-24T00:00:00.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/en/news/2022/10/07/growi-private-page-can-be-viewed/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN00845253/index.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-41799",
    "datePublished": "2022-10-24T00:00:00.000Z",
    "dateReserved": "2022-09-30T00:00:00.000Z",
    "dateUpdated": "2025-05-07T16:12:01.378Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-54806 (GCVE-0-2025-54806)

Vulnerability from cvelistv5 – Published: 2025-10-23 04:10 – Updated: 2025-10-23 15:05

Summary

GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user's web browser.

Severity

6.1 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://growi.co.jp/news/38/
https://jvn.jp/en/jp/JVN46526244/

Impacted products

1 product

Vendor	Product	Version
GROWI, Inc.	GROWI	Affected: v4.2.7 and earlier

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-54806",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-23T15:04:03.231658Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-23T15:05:14.336Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "GROWI, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v4.2.7 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability  in the page alert function. If a user accesses a crafted URL while logged in to the affected product, an arbitrary script may be executed on the user\u0027s web browser."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "Cross-site scripting (XSS)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-23T04:10:59.281Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://growi.co.jp/news/38/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN46526244/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-54806",
    "datePublished": "2025-10-23T04:10:59.281Z",
    "dateReserved": "2025-10-15T05:16:42.225Z",
    "dateUpdated": "2025-10-23T15:05:14.336Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-42436 (GCVE-0-2023-42436)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:22 – Updated: 2024-08-02 19:16

Summary

Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v3.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:16:51.003Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v3.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:22:50.373Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-42436",
    "datePublished": "2023-12-26T07:22:50.373Z",
    "dateReserved": "2023-12-07T02:39:45.772Z",
    "dateUpdated": "2024-08-02T19:16:51.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50332 (GCVE-0-2023-50332)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:21 – Updated: 2024-08-02 22:16

Summary

Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user's intention.

Severity

No CVSS data available.

CWE

Improper authorization

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:16:46.265Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user\u0027s intention.\r\n"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper authorization",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:24.393Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-50332",
    "datePublished": "2023-12-26T07:21:24.393Z",
    "dateReserved": "2023-12-07T02:39:51.268Z",
    "dateUpdated": "2024-08-02T22:16:46.265Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50294 (GCVE-0-2023-50294)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:21 – Updated: 2024-08-02 22:16

Summary

The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.

Severity

No CVSS data available.

CWE

Cleartext storage of sensitive information

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:16:46.259Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cleartext storage of sensitive information",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:19.831Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-50294",
    "datePublished": "2023-12-26T07:21:19.831Z",
    "dateReserved": "2023-12-07T02:39:43.973Z",
    "dateUpdated": "2024-08-02T22:16:46.259Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50175 (GCVE-0-2023-50175)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:21 – Updated: 2025-04-23 15:59

Summary

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Cross-site scripting (XSS)
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:09:49.793Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-50175",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-02T17:53:10.816140Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T15:59:54.774Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:15.728Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-50175",
    "datePublished": "2023-12-26T07:21:15.728Z",
    "dateReserved": "2023-12-07T02:39:52.053Z",
    "dateUpdated": "2025-04-23T15:59:54.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-49807 (GCVE-0-2023-49807)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:21 – Updated: 2024-08-02 22:01

Summary

Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:01:26.024Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:11.658Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-49807",
    "datePublished": "2023-12-26T07:21:11.658Z",
    "dateReserved": "2023-12-07T02:39:44.808Z",
    "dateUpdated": "2024-08-02T22:01:26.024Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-49779 (GCVE-0-2023-49779)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:21 – Updated: 2024-08-02 22:01

Summary

Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:01:25.681Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:06.972Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-49779",
    "datePublished": "2023-12-26T07:21:06.972Z",
    "dateReserved": "2023-12-07T02:39:53.189Z",
    "dateUpdated": "2024-08-02T22:01:25.681Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-49598 (GCVE-0-2023-49598)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:21 – Updated: 2024-08-02 22:01

Summary

Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:01:25.946Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:21:02.611Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-49598",
    "datePublished": "2023-12-26T07:21:02.611Z",
    "dateReserved": "2023-12-07T02:39:42.967Z",
    "dateUpdated": "2024-08-02T22:01:25.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-49119 (GCVE-0-2023-49119)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:20 – Updated: 2024-11-27 15:22

Summary

Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:46:29.293Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-49119",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-10T20:31:53.312588Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-27T15:22:12.385Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:58.393Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-49119",
    "datePublished": "2023-12-26T07:20:58.393Z",
    "dateReserved": "2023-12-07T02:39:46.701Z",
    "dateUpdated": "2024-11-27T15:22:12.385Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-47215 (GCVE-0-2023-47215)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:20 – Updated: 2024-08-02 21:01

Summary

Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T21:01:22.674Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:53.804Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-47215",
    "datePublished": "2023-12-26T07:20:53.804Z",
    "dateReserved": "2023-12-07T02:39:47.663Z",
    "dateUpdated": "2024-08-02T21:01:22.674Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-46699 (GCVE-0-2023-46699)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:20 – Updated: 2024-09-12 12:36

Summary

Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user's intention.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Cross-site request forgery (CSRF)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v6.0.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:53:20.881Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-46699",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-04T18:22:27.439104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T12:36:17.923Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v6.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user\u0027s intention."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site request forgery (CSRF)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:48.092Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-46699",
    "datePublished": "2023-12-26T07:20:48.092Z",
    "dateReserved": "2023-12-07T02:39:49.423Z",
    "dateUpdated": "2024-09-12T12:36:17.923Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45740 (GCVE-0-2023-45740)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:20 – Updated: 2025-04-23 16:03

Summary

Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Cross-site scripting (XSS)
CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v4.1.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:29:32.245Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-45740",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-01-02T17:52:27.722596Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-79",
                "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-23T16:03:49.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v4.1.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:42.853Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-45740",
    "datePublished": "2023-12-26T07:20:42.853Z",
    "dateReserved": "2023-12-07T02:39:50.226Z",
    "dateUpdated": "2025-04-23T16:03:49.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-45737 (GCVE-0-2023-45737)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:20 – Updated: 2024-08-02 20:29

Summary

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: prior to v3.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T20:29:32.277Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "prior to v3.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:36.390Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-45737",
    "datePublished": "2023-12-26T07:20:36.390Z",
    "dateReserved": "2023-12-07T02:39:48.512Z",
    "dateUpdated": "2024-08-02T20:29:32.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-50339 (GCVE-0-2023-50339)

Vulnerability from cvelistv5 – Published: 2023-12-26 07:20 – Updated: 2024-09-09 18:00

Summary

Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.

Severity

No CVSS data available.

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Cross-site scripting (XSS)

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/ja/news/2023/11/21/growi-pre…
https://jvn.jp/en/jp/JVN18715935/

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI	Affected: v6.1.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T22:16:46.697Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN18715935/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-50339",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-02-27T18:02:51.280364Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-09T18:00:25.425Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "v6.1.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting (XSS)",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-26T07:20:31.556Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/ja/news/2023/11/21/growi-prevent-xss6/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN18715935/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2023-50339",
    "datePublished": "2023-12-26T07:20:31.556Z",
    "dateReserved": "2023-12-07T02:39:54.055Z",
    "dateUpdated": "2024-09-09T18:00:25.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-41799 (GCVE-0-2022-41799)

Vulnerability from cvelistv5 – Published: 2022-10-24 00:00 – Updated: 2025-05-07 16:12

Summary

Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Improper Access Control
CWE-noinfo Not enough information

Assigner

jpcert

References

2 references

URL	Tags
https://weseek.co.jp/en/news/2022/10/07/growi-pri…
https://jvn.jp/en/jp/JVN00845253/index.html

Impacted products

1 product

Vendor	Product	Version
WESEEK, Inc.	GROWI v5 series and v4 series	Affected: versions prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:56:38.188Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/en/news/2022/10/07/growi-private-page-can-be-viewed/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/jp/JVN00845253/index.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-41799",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-07T16:11:29.358137Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-07T16:12:01.378Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI v5 series and v4 series",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-10-24T00:00:00.000Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://weseek.co.jp/en/news/2022/10/07/growi-private-page-can-be-viewed/"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN00845253/index.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2022-41799",
    "datePublished": "2022-10-24T00:00:00.000Z",
    "dateReserved": "2022-09-30T00:00:00.000Z",
    "dateUpdated": "2025-05-07T16:12:01.378Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

86 vulnerabilities by weseek

CVE-2025-54806 (GCVE-0-2025-54806)

CVE-2023-50339 (GCVE-0-2023-50339)

CVE-2023-50332 (GCVE-0-2023-50332)

CVE-2023-50294 (GCVE-0-2023-50294)

CVE-2023-50175 (GCVE-0-2023-50175)

CVE-2023-49807 (GCVE-0-2023-49807)

CVE-2023-49779 (GCVE-0-2023-49779)

CVE-2023-49598 (GCVE-0-2023-49598)

CVE-2023-49119 (GCVE-0-2023-49119)

CVE-2023-47215 (GCVE-0-2023-47215)

CVE-2023-46699 (GCVE-0-2023-46699)

CVE-2023-45740 (GCVE-0-2023-45740)

CVE-2023-45737 (GCVE-0-2023-45737)

CVE-2023-42436 (GCVE-0-2023-42436)

CVE-2022-41799 (GCVE-0-2022-41799)

CVE-2025-54806 (GCVE-0-2025-54806)

CVE-2023-42436 (GCVE-0-2023-42436)

CVE-2023-50332 (GCVE-0-2023-50332)

CVE-2023-50294 (GCVE-0-2023-50294)

CVE-2023-50175 (GCVE-0-2023-50175)

CVE-2023-49807 (GCVE-0-2023-49807)

CVE-2023-49779 (GCVE-0-2023-49779)

CVE-2023-49598 (GCVE-0-2023-49598)

CVE-2023-49119 (GCVE-0-2023-49119)

CVE-2023-47215 (GCVE-0-2023-47215)

CVE-2023-46699 (GCVE-0-2023-46699)

CVE-2023-45740 (GCVE-0-2023-45740)

CVE-2023-45737 (GCVE-0-2023-45737)

CVE-2023-50339 (GCVE-0-2023-50339)

CVE-2022-41799 (GCVE-0-2022-41799)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

86 vulnerabilities by weseek

CVE-2025-54806 (GCVE-0-2025-54806)

CVE-2023-50339 (GCVE-0-2023-50339)

CVE-2023-50332 (GCVE-0-2023-50332)

CVE-2023-50294 (GCVE-0-2023-50294)

CVE-2023-50175 (GCVE-0-2023-50175)

CVE-2023-49807 (GCVE-0-2023-49807)

CVE-2023-49779 (GCVE-0-2023-49779)

CVE-2023-49598 (GCVE-0-2023-49598)

CVE-2023-49119 (GCVE-0-2023-49119)

CVE-2023-47215 (GCVE-0-2023-47215)

CVE-2023-46699 (GCVE-0-2023-46699)

CVE-2023-45740 (GCVE-0-2023-45740)

CVE-2023-45737 (GCVE-0-2023-45737)

CVE-2023-42436 (GCVE-0-2023-42436)

CVE-2022-41799 (GCVE-0-2022-41799)

CVE-2025-54806 (GCVE-0-2025-54806)

CVE-2023-42436 (GCVE-0-2023-42436)

CVE-2023-50332 (GCVE-0-2023-50332)

CVE-2023-50294 (GCVE-0-2023-50294)

CVE-2023-50175 (GCVE-0-2023-50175)

CVE-2023-49807 (GCVE-0-2023-49807)

CVE-2023-49779 (GCVE-0-2023-49779)

CVE-2023-49598 (GCVE-0-2023-49598)

CVE-2023-49119 (GCVE-0-2023-49119)

CVE-2023-47215 (GCVE-0-2023-47215)

CVE-2023-46699 (GCVE-0-2023-46699)

CVE-2023-45740 (GCVE-0-2023-45740)

CVE-2023-45737 (GCVE-0-2023-45737)

CVE-2023-50339 (GCVE-0-2023-50339)

CVE-2022-41799 (GCVE-0-2022-41799)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.