GHSA-jq57-3w7p-vwvv
Docassemble unauthorized access through URL manipulation
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | docassemble.webapp | >= 1.4.53, < 1.4.97 | 1.4.97 |
| PyPI | docassemble.base | >= 1.4.53, < 1.4.97 | 1.4.97 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96.
### Patches
The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched.
### Workarounds
If upgrading is not possible, manually apply the changes of [97f77dc](https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9) and restart the server.
### Credit
The vulnerability was discovered by Riyush Ghimire (@richighimi).
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [docassemble](https://github.com/jhpyle/docassemble/issues)
* Join the [Slack channel](https://join.slack.com/t/docassemble/shared_invite/zt-2cspzjo9j-YyE7SrLmi5muAvnPv~Bz~A)
* Email us at [email protected]
References
External links from the advisory. They lead to third-party sites.