CVE-2024-35184

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-35184
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35184.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-35184
Aliases
  • GHSA-72w4-hxqq-c256
Published
2024-05-15T21:29:33.712Z
Modified
2026-07-15T01:49:08.072734750Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
paperless-ngx's remote user auth via header works even when disabling it for API
Details

Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-287"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/35xxx/CVE-2024-35184.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/paperless-ngx/paperless-ngx

Affected ranges

Type
GIT
Repo
https://github.com/paperless-ngx/paperless-ngx
Events
Introduced
97dceba783a9f641bcfdc3b6c27b603bb59a41ab
Fixed
ed05b40ba461641b1b59b0a92f51f3f6a66ce180
Fixed
317a9114ebdb770926e9f6229d3b8e5fa7ef3eb3
Database specific 
{
    "extracted_events": [
        {
            "introduced": "2.5.0"
        },
        {
            "fixed": "2.8.6"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.5.0
v2.5.1
v2.5.2
v2.5.3
v2.5.4
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.7.1
v2.7.2
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-35184.json"