CVE-2024-27292

    Dashboard / Vulnerabilities / CVE-2024-27292

    CVE-2024-27292

    Published: 29 Feb 2024Last Modified: 12 Aug 2026

    Summary: Docassemble unauthorized access through URL manipulation

    Details: Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27292.json, https://github.com/jhpyle/docassemble/security/advisories/GHSA-jq57-3w7p-vwvv, https://nvd.nist.gov/vuln/detail/CVE-2024-27292, https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 73128fd50b2bc18374c7601fee32fd82d193256f
    Fixed -539aeae12cd08cb5c951a3e51fe317b38e4fb9e7

    Affected versions

    v1.4.96
    v1.4.95
    v1.4.94
    v1.4.93
    v1.4.92
    v1.4.91
    v1.4.90
    v1.4.89
    v1.4.88
    v1.4.87
    v1.4.86
    v1.4.85
    v1.4.84
    v1.4.83
    v1.4.82
    v1.4.81
    v1.4.80
    v1.4.79
    v1.4.78
    v1.4.77
    v1.4.76
    v1.4.75
    v1.4.74
    v1.4.73
    v1.4.72
    v1.4.71
    v1.4.70
    v1.4.69
    v1.4.68
    v1.4.67
    v1.4.66
    v1.4.65
    v1.4.64
    v1.4.63
    v1.4.62
    v1.4.61
    v1.4.60
    v1.4.59
    v1.4.58
    v1.4.57
    v1.4.56
    v1.4.55
    v1.4.54
    v1.4.53

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-27292 | CVE-DB