What is GHSA-pj36-fcrg-327j?

GHSA-pj36-fcrg-327j is a security advisory published by GitHub Security Advisories with High severity. BookStack Incorrect Access Control vulnerability

Which CVE IDs does GHSA-pj36-fcrg-327j cover?

GHSA-pj36-fcrg-327j covers the following CVE IDs: CVE-2024-36676. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pj36-fcrg-327j?

GHSA-pj36-fcrg-327j has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-pj36-fcrg-327j?

GHSA-pj36-fcrg-327j affects 1 product, including: composer/ssddanbrown/bookstack:\u003c 24.05.1.

GHSA-pj36-fcrg-327jHighCVSS 8.2

BookStack Incorrect Access Control vulnerability

Vendor

GitHub Security Advisories

Published

July 10, 2024

Last Modified

July 31, 2024

🔗 CVE IDs covered (1)

CVE-2024-36676 →

📋 Description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

🎯 Affected products1

composer/ssddanbrown/bookstack:< 24.05.1

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2024-36676
https://github.com/BookStackApp/BookStack/issues/4993
https://github.com/BookStackApp/BookStack/releases/tag/v24.05.1
https://www.bookstackapp.com/blog/bookstack-release-v24-05-1
https://github.com/BookStackApp/BookStack/commit/69af9e0dbdefd8c6c951e8afbe2bba141d454beb
https://github.com/advisories/GHSA-pj36-fcrg-327j