CVE-2024-27292

Docassemble unauthorized access through URL manipulation

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.

Affected

jhpyle · docassemble

CVSS v3.1 GITHUB

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

69.49% chance of exploitation in the next 30 days, 99th percentile

Nuclei

high · CWE-706

Published

2024-02-29

Updated

2024-08-02

Proof-of-concept exploits (3)

• NingXin2002/Docassemble_poc3★ · 2024-12-21
• tequilasunsh1ne/CVE_2024_272920★ · 2024-07-08
• th3gokul/CVE-2024-272927★ · 2024-07-02

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27292.yaml

Security advisories

• jhpyle/docassemble/security/advisories/GHSA-jq57-3w7p-vwvv
• advisories/GHSA-jq57-3w7p-vwvv
• jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9

References

• CVE Record
• NVD entry

Related

• CVE-2024-23692
• CVE-2024-40348
• CVE-2024-41319
• CVE-2023-7309
• CVE-2024-22024
• CVE-2024-39943