CyberRota Analysis
AI-GeneratedGROWI has an access control vulnerability in the GET /_api/v3/attachment/:id endpoint, allowing authenticated attackers to bypass page access permissions and retrieve metadata for attachments from restricted pages by using known identifiers. This could lead to unauthorized information disclosure, potentially exposing sensitive data. Organizations using GROWI should prioritize remediation to protect against potential data leaks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment identifiers.