PYSEC-2021-836

    Dashboard / Vulnerabilities / PYSEC-2021-836

    PYSEC-2021-836

    Published: 6 Dec 2021Last Modified: 8 Nov 2023

    Summary:

    Details: Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

    References: https://github.com/inveniosoftware/invenio-drafts-resources/commit/039b0cff1ad4b952000f4d8c3a93f347108b6626, https://github.com/inveniosoftware/invenio-drafts-resources/security/advisories/GHSA-xr38-w74q-r8jv

    Affected packages

    Package

    Name: invenio-drafts-resources

    Purl: pkg:pypi/invenio-drafts-resources

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -039b0cff1ad4b952000f4d8c3a93f347108b6626

    Affected versions

    0.1.0
    0.1.2
    0.1.3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2021-836 | CVE-DB