Information Disclosure in ShowDoc 2.4.1 by CCCCCrash
CVE-2018-19609

6.5MEDIUM

Key Information:

Vendor

Showdoc

Status
Showdoc
Vendor
CVE Published:
27 November 2018

What is CVE-2018-19609?

The vulnerability in ShowDoc version 2.4.1 allows remote attackers to gain unauthorized access to sensitive information by manipulating the page_id parameter. This exploit can lead to the exposure of private note content and even user details via JSON data at different URLs. The lack of proper access controls enables unauthorized users to exploit this weakness effectively.

References

https://github.com/CCCCCrash/POCs/tree/master/Web/showdoc...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.