jvndb - jvndb-2021-001123

jvndb-2021-001123

Vulnerability from jvndb

Published

2021-03-09 14:17

Modified

2021-09-24 13:34

Severity ?

3.7 (Low) - cvssV3_0 - CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Summary

Multiple vulnerabilities in GROWI

Details

GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below. Stored Cross-site Scripting (CWE-79) - CVE-2021-20667 Path Traversal (CWE-22) - CVE-2021-20668 Path Traversal (CWE-22) - CVE-2021-20669 Improper Access Control (CWE-284) - CVE-2021-20670 Improper Input Validation (CWE-20) - CVE-2021-20671 Site Scripting (CWE-79) - CVE-2021-20829 stypr of Flatt Security Inc. reported these vulnerabilities to the developer and coordinated on his own. After coordination was completed, this case was reported to JPCERT/CC, and JPCERT/CC coordinated with the developer for the publication.

References

▼	Type	URL
	JVN	https://jvn.jp/en/vu/JVNVU94889258/
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20667
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20668
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20669
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20670
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20671
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20829
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-20667
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-20668
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-20669
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-20670
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-20671
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2021-20829
	Improper Input Validation(CWE-20)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html
	Improper Access Control(CWE-284)	https://cwe.mitre.org/data/definitions/284.html
	Cross-site Scripting(CWE-79)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	WESEEK, Inc.	GROWI
	WESEEK, Inc.	GROWI

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-001123.html",
  "dc:date": "2021-09-24T13:34+09:00",
  "dcterms:issued": "2021-03-09T14:17+09:00",
  "dcterms:modified": "2021-09-24T13:34+09:00",
  "description": "GROWI provided by WESEEK, Inc. contains multiple vulnerabilities listed below.\r\n\r\n    Stored Cross-site Scripting (CWE-79) - CVE-2021-20667\r\n    Path Traversal (CWE-22) - CVE-2021-20668\r\n    Path Traversal (CWE-22) - CVE-2021-20669\r\n    Improper Access Control (CWE-284) - CVE-2021-20670\r\n    Improper Input Validation (CWE-20) - CVE-2021-20671\r\n    Site Scripting (CWE-79) - CVE-2021-20829\r\n\r\nstypr of Flatt Security Inc. reported these vulnerabilities to the developer and coordinated on his own.\r\nAfter coordination was completed, this case was reported to JPCERT/CC, and JPCERT/CC coordinated with the developer for the publication.",
  "link": "https://jvndb.jvn.jp/en/contents/2021/JVNDB-2021-001123.html",
  "sec:cpe": [
    {
      "#text": "cpe:/a:weseek:growi",
      "@product": "GROWI",
      "@vendor": "WESEEK, Inc.",
      "@version": "2.2"
    },
    {
      "#text": "cpe:/a:weseek:growi",
      "@product": "GROWI",
      "@vendor": "WESEEK, Inc.",
      "@version": "2.2"
    }
  ],
  "sec:cvss": {
    "@score": "3.7",
    "@severity": "Low",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2021-001123",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/vu/JVNVU94889258/",
      "@id": "JVNVU#94889258",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20667",
      "@id": "CVE-2021-20667",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20668",
      "@id": "CVE-2021-20668",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20669",
      "@id": "CVE-2021-20669",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20670",
      "@id": "CVE-2021-20670",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20671",
      "@id": "CVE-2021-20671",
      "@source": "CVE"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20829",
      "@id": "CVE-2021-20829",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20667",
      "@id": "CVE-2021-20667",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20668",
      "@id": "CVE-2021-20668",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20669",
      "@id": "CVE-2021-20669",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20670",
      "@id": "CVE-2021-20670",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20671",
      "@id": "CVE-2021-20671",
      "@source": "NVD"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2021-20829",
      "@id": "CVE-2021-20829",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-20",
      "@title": "Improper Input Validation(CWE-20)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    },
    {
      "#text": "https://cwe.mitre.org/data/definitions/284.html",
      "@id": "CWE-284",
      "@title": "Improper Access Control(CWE-284)"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-79",
      "@title": "Cross-site Scripting(CWE-79)"
    }
  ],
  "title": "Multiple vulnerabilities in GROWI"
}

cve-2021-20671

Vulnerability from cvelistv5

Published

2021-03-10 09:20

Modified

2024-08-03 17:45

Severity ?

Summary

Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite the files on the server, which may lead to arbitrary code execution.

References

▼	URL	Tags
	https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/	x_refsource_MISC
	https://jvn.jp/en/vu/JVNVU94889258/index.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	WESEEK, Inc.	GROWI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:45:45.225Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions v4.2.2 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite the files on the server, which may lead to arbitrary code execution."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-10T09:20:34",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20671",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GROWI",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions v4.2.2 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "WESEEK, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Invalid file validation on the upload feature in GROWI versions v4.2.2 allows a remote attacker with administrative privilege to overwrite the files on the server, which may lead to arbitrary code execution."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/",
              "refsource": "MISC",
              "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
            },
            {
              "name": "https://jvn.jp/en/vu/JVNVU94889258/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20671",
    "datePublished": "2021-03-10T09:20:34",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:45:45.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-20670

Vulnerability from cvelistv5

Published

2021-03-10 09:20

Modified

2024-08-03 17:45

Severity ?

Summary

Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user's personal information and/or server's internal information via unspecified vectors.

References

▼	URL	Tags
	https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/	x_refsource_MISC
	https://jvn.jp/en/vu/JVNVU94889258/index.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	WESEEK, Inc.	GROWI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:45:45.348Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions v4.2.2 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user\u0027s personal information and/or server\u0027s internal information via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Access Control",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-10T09:20:33",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20670",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GROWI",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions v4.2.2 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "WESEEK, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper access control vulnerability in GROWI versions v4.2.2 and earlier allows a remote unauthenticated attacker to read the user\u0027s personal information and/or server\u0027s internal information via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Access Control"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/",
              "refsource": "MISC",
              "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
            },
            {
              "name": "https://jvn.jp/en/vu/JVNVU94889258/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20670",
    "datePublished": "2021-03-10T09:20:33",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:45:45.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-20668

Vulnerability from cvelistv5

Published

2021-03-10 09:20

Modified

2024-08-03 17:45

Severity ?

Summary

Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL.

References

▼	URL	Tags
	https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/	x_refsource_MISC
	https://jvn.jp/en/vu/JVNVU94889258/index.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	WESEEK, Inc.	GROWI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:45:45.504Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions v4.2.2 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Path Traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-10T09:20:31",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20668",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GROWI",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions v4.2.2 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "WESEEK, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read an arbitrary path via a specially crafted URL."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Path Traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/",
              "refsource": "MISC",
              "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
            },
            {
              "name": "https://jvn.jp/en/vu/JVNVU94889258/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20668",
    "datePublished": "2021-03-10T09:20:31",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:45:45.504Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-20667

Vulnerability from cvelistv5

Published

2021-03-10 09:20

Modified

2024-08-03 17:45

Severity ?

Summary

Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content.

References

▼	URL	Tags
	https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/	x_refsource_MISC
	https://jvn.jp/en/vu/JVNVU94889258/index.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	WESEEK, Inc.	GROWI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:45:45.356Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions v4.2.2 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-10T09:20:30",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20667",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GROWI",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions v4.2.2 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "WESEEK, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/",
              "refsource": "MISC",
              "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
            },
            {
              "name": "https://jvn.jp/en/vu/JVNVU94889258/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20667",
    "datePublished": "2021-03-10T09:20:31",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:45:45.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-20669

Vulnerability from cvelistv5

Published

2021-03-10 09:20

Modified

2024-08-03 17:45

Severity ?

Summary

Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbitrary path via a specially crafted URL.

References

▼	URL	Tags
	https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/	x_refsource_MISC
	https://jvn.jp/en/vu/JVNVU94889258/index.html	x_refsource_MISC

Impacted products

▼	Vendor	Product
	WESEEK, Inc.	GROWI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:45:45.355Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions v4.2.2 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbitrary path via a specially crafted URL."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Path Traversal",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-03-10T09:20:32",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20669",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GROWI",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions v4.2.2 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "WESEEK, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Path traversal vulnerability in GROWI versions v4.2.2 and earlier allows an attacker with administrator rights to read and/or delete an arbitrary path via a specially crafted URL."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Path Traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/",
              "refsource": "MISC",
              "url": "https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/"
            },
            {
              "name": "https://jvn.jp/en/vu/JVNVU94889258/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20669",
    "datePublished": "2021-03-10T09:20:32",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:45:45.355Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2021-20829

Vulnerability from cvelistv5

Published

2021-09-21 09:25

Modified

2024-08-03 17:53

Severity ?

Summary

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page.

References

▼	URL	Tags
	https://jvn.jp/en/vu/JVNVU94889258/index.html	x_refsource_MISC
	https://weseek.co.jp/security/2021/09/17/vulnerability/growi-prevent-multiple-xss-addition/	x_refsource_MISC

Impacted products

▼	Vendor	Product
	WESEEK, Inc.	GROWI

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T17:53:23.057Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://weseek.co.jp/security/2021/09/17/vulnerability/growi-prevent-multiple-xss-addition/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "GROWI",
          "vendor": "WESEEK, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "versions v4.2.19 and earlier"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Cross-site scripting",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-21T09:25:10",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://weseek.co.jp/security/2021/09/17/vulnerability/growi-prevent-multiple-xss-addition/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2021-20829",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "GROWI",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "versions v4.2.19 and earlier"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "WESEEK, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Cross-site scripting"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://jvn.jp/en/vu/JVNVU94889258/index.html",
              "refsource": "MISC",
              "url": "https://jvn.jp/en/vu/JVNVU94889258/index.html"
            },
            {
              "name": "https://weseek.co.jp/security/2021/09/17/vulnerability/growi-prevent-multiple-xss-addition/",
              "refsource": "MISC",
              "url": "https://weseek.co.jp/security/2021/09/17/vulnerability/growi-prevent-multiple-xss-addition/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2021-20829",
    "datePublished": "2021-09-21T09:25:10",
    "dateReserved": "2020-12-17T00:00:00",
    "dateUpdated": "2024-08-03T17:53:23.057Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

jvndb-2021-001123

Vulnerability from jvndb

cve-2021-20671

Vulnerability from cvelistv5

cve-2021-20670

Vulnerability from cvelistv5

cve-2021-20668

Vulnerability from cvelistv5

cve-2021-20667

Vulnerability from cvelistv5

cve-2021-20669

Vulnerability from cvelistv5

cve-2021-20829

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature