Vulnerability · Published Feb 29, 2024 · Assigned by GitHub_M
CVE-2024-27292Docassemble unauthorized access through URL manipulation
High 7.5
In plain English
A high-severity security flaw in docassemble from jhpyle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 69.5% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | docassemble-base | 1.4.97 | GHSA-jq57-3w7p-vwvv |
| PyPI | docassemble-base | 1.4.97 | PYSEC-2026-1309 |
| PyPI | docassemble-webapp | 1.4.97 | GHSA-jq57-3w7p-vwvv |
| PyPI | docassemble-webapp | 1.4.97 | PYSEC-2026-2453 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| jhpyle | docassemble | >= 1.4.53, < 1.4.97 |
Weakness: CWE-706 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N