Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation
Vulnerability Description
Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated user to overwrite another page's attachment within the same workspace by supplying a victim `attachmentId` to `POST /api/files/upload`. This is a remote integrity issue requiring no victim interaction. Version 0.71.0 contains a patch.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Vulnerability Type
通过用户控制密钥绕过授权机制
Vulnerability Title
Docmost 安全漏洞
Vulnerability Description
Docmost是Docmost开源的一个开协作维基和文档软件。 Docmost 0.3.0至0.71.0之前版本存在安全漏洞，该漏洞源于授权不当，可能导致低权限认证用户通过提供受害者attachmentId来覆盖同一工作空间中其他页面的附件。
CVSS Information
N/A
Vulnerability Type
N/A