Vulnerability · Published Oct 24, 2022 · Assigned by jpcert
CVE-2022-41799
Medium 6.5
In plain English
A medium-severity security flaw in GROWI v5 series and v4 series from WESEEK, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)1.0%top 38.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| WESEEK, Inc. | GROWI v5 series and v4 series | versions prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) |