CyberRota Analysis
AI-GeneratedSiYuan versions prior to 3.7.4 are vulnerable to a brute-force attack on the publish passwords for notebooks due to inadequate restrictions on authentication attempts at the authFilePublishAccess endpoint. This flaw allows unauthenticated attackers to submit unlimited password guesses, potentially compromising sensitive data in password-protected notebooks. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SiYuan before 3.7.4 contains an improper restriction of excessive authentication attempts vulnerability in the authFilePublishAccess endpoint that allows unauthenticated attackers to brute-force per-notebook publish passwords. Attackers can submit unbounded password guesses without rate limiting or CAPTCHA to gain access to password-protected published notebooks.