CVE-2022-41799

State: Published
Severity: 6.5 Medium
Published: Oct 24, 2022
Updated: May 7, 2025
Reserved: Sep 30, 2022

Description

Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.

Scores

CVSS	Score	Vector	Source
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
GROWI v5 series and v4 seriesWESEEK, Inc.	versions prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series)Affected

References

https://weseek.co.jp/en/news/2022/10/07/growi-private-page-can-be-viewed/
https://jvn.jp/en/jp/JVN00845253/index.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.