CVE-2019-13337 | BDVDB-2026-118908 Detail

Description#

In WESEEK GROWI before 3.5.0, the site-wide basic authentication can be bypassed by adding a URL parameter access_token (this is the parameter used by the API). No valid token is required since it is not validated by the backend. The website can then be browsed as if no basic authentication is required.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12019-07-09Record published in the CVE List.
2. Version 22024-08-04Most recent update recorded in the CVE List.