What’s Vulnerable › Vulnerabilities

CVE-2022-1236: Weak Password Requirements in weseek/growi

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-05 · updated 2026-06-17
• Weakness: CWE-521

Description

Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.

Affected products

• WESEEK, Inc. GROWI: before 5.0.0 — fixed in 5.0.0

How to fix

Upgrade to a fixed version: WESEEK, Inc. GROWI 5.0.0. Check the vendor advisory for mitigations.

References

• https://github.com/weseek/growi/commit/b584e2a47ee3c8ce1d8ef38238302825c015327e
• https://huntr.dev/bounties/c7df088f-e355-45e6-9267-e41030dc6a32
• https://github.com/weseek/growi/commit/b584e2a47ee3c8ce1d8ef38238302825c015327e
• https://huntr.dev/bounties/c7df088f-e355-45e6-9267-e41030dc6a32

Get alerted when CVE-2022-1236 or the next vulnerability affects your stack