Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Wimi Teamwork On-Premises < 8.2.0 IDOR via preview.php
Vulnerability Description
Wimi Teamwork On-Premises versions prior to 8.2.0 contain an insecure direct object reference vulnerability in the preview.php endpoint where the item_id parameter lacks proper authorization checks. Attackers can enumerate sequential item_id values to access and retrieve image previews from other users' private or group conversations, resulting in unauthorized disclosure of sensitive information.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Vulnerability Type
通过用户控制密钥绕过授权机制
Vulnerability Title
Wimi Teamwork On-Premises 安全漏洞
Vulnerability Description
Wimi Teamwork On-Premises是法国Teamwork公司的一个企业协作平台。 Wimi Teamwork On-Premises 8.2.0之前版本存在安全漏洞，该漏洞源于preview.php端点存在不安全的直接对象引用，可能导致未授权信息泄露。
CVSS Information
N/A
Vulnerability Type
N/A