CVE-2022-24837
Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents.
Does this matter?
Lower severity and a low EPSS score (1.13%). Track it; it rarely justifies an emergency change on its own.
Description
HedgeDoc is an open-source, web-based, self-hosted, collaborative markdown editor. Images uploaded with HedgeDoc version 1.9.1 and later have an enumerable filename after the upload, resulting in potential information leakage of uploaded documents. This is especially relevant for private notes and affects all upload backends, except Lutim and imgur. This issue is patched in version 1.9.3 by replacing the filename generation with UUIDv4. If you cannot upgrade to HedgeDoc 1.9.3, it is possible to block POST requests to `/uploadimage`, which will disable future uploads.
- CVSS 3.1
- 5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.13% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200, CWE-434
- Affected
- hedgedoc/hedgedoc
- Source
- security-advisories@github.com
References
- https://github.com/hedgedoc/hedgedoc/commit/9e2f9e21e904c4a319e84265da7ef03b0a8e343aPatch, Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-q6vv-2q26-j7rxPatch, Third Party Advisory
- https://github.com/node-formidable/formidable/issues/808Issue Tracking, Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/commit/9e2f9e21e904c4a319e84265da7ef03b0a8e343aPatch, Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-q6vv-2q26-j7rxPatch, Third Party Advisory
- https://github.com/node-formidable/formidable/issues/808Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.