CVE-2021-43781
December 06, 2021
Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. cannot change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.
Affected Packages
invenio-app-rdm (PYTHON):
Affected version(s) >=7.0.0.dev0 <7.0.0.dev5Fix Suggestion:
Update to version 7.0.0.dev5invenio-app-rdm (PYTHON):
Affected version(s) >=0.6.0 <6.0.5Fix Suggestion:
Update to version 6.0.5invenio-rdm-records (PYTHON):
Affected version(s) >=0.9.0 <0.32.6Fix Suggestion:
Update to version 0.32.6invenio-drafts-resources (PYTHON):
Affected version(s) >=0.1.0 <0.13.7Fix Suggestion:
Update to version 0.13.7invenio-rdm-records (PYTHON):
Affected version(s) >=0.33.0 <0.33.10Fix Suggestion:
Update to version 0.33.10invenio-drafts-resources (PYTHON):
Affected version(s) >=0.14.0 <0.14.6Fix Suggestion:
Update to version 0.14.6Additional Notes
The description of this vulnerability differs from MITRE.
Related Resources (5)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
CVSS v3
Base Score:
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE
CVSS v2
Base Score:
4
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
EPSS
Base Score:
0.14
