CVE-2022-41799

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-10-24 · updated 2026-06-17

Description

Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download the markdown data from the pages set to private by the other users.

Affected products

WESEEK, Inc. GROWI: from 4.0.0 before 4.5.25; from 5.0.0 before 5.1.4 — fixed in 4.5.25, 5.1.4

How to fix

Upgrade to a fixed version: WESEEK, Inc. GROWI 4.5.25, 5.1.4. Check the vendor advisory for mitigations.

References

https://jvn.jp/en/jp/JVN00845253/index.html
https://weseek.co.jp/en/news/2022/10/07/growi-private-page-can-be-viewed/
https://jvn.jp/en/jp/JVN00845253/index.html
https://weseek.co.jp/en/news/2022/10/07/growi-private-page-can-be-viewed/

Get alerted when CVE-2022-41799 or the next vulnerability affects your stack