Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2024-27292

Good to know:

icon

Date: February 29, 2024

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.

Language: Python

Severity Score

Related Resources (5)

https://github.com/jhpyle/docassemble
https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9
https://nvd.nist.gov/vuln/detail/CVE-2024-27292
https://github.com/jhpyle/docassemble/security/advisories/GHSA-jq57-3w7p-vwvv
https://www.mend.io/vulnerability-database/CVE-2024-27292

Severity Score

Weakness Type (CWE)

Use of Incorrectly-Resolved Name or Reference

CWE-706

Top Fix

icon

Upgrade Version

Upgrade to version docassemble.webapp - 1.4.97, docassemble.base - 1.4.97

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

Do you need more information?

Contact Us