CVE-2018-19609

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-19609

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-19609.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-19609

Aliases

GHSA-6xx7-cphv-pxgr

Published

2018-11-27T16:29:01Z

Modified

2026-08-07T15:11:24Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

[none]

Details

ShowDoc 2.4.1 allows remote attackers to obtain sensitive information by navigating with a modified page_id, as demonstrated by reading note content, or discovering a username in the JSON data at a diff URL.

References

https://github.com/CCCCCrash/POCs/tree/master/Web/showdoc/IncorrectAccessControl

Affected packages

Git / github.com/star7th/showdoc

Affected ranges

Type

GIT

Repo

https://github.com/star7th/showdoc

Events

Introduced

db6ce58863ff2147e6f6631a00fd5e71efa82541

Last Affected

db6ce58863ff2147e6f6631a00fd5e71efa82541

Database specific

Show details

{
    "cpe": "cpe:2.3:a:showdoc:showdoc:2.4.1:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.4.1"
        },
        {
            "last_affected": "2.4.1"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*

2.4.1

v2.*

v2.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-19609.json"