CVE-2018-19609: Showdoc Forced Browsing
Summary
CVE-2018-19609: Showdoc Forced Browsing. Affects showdoc/showdoc versions < 2.4.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ShowDoc is a package available on Packagist that provides functionality for creating and managing documentation. It allows users to navigate through different pages and access content based on page IDs. However, a vulnerability in ShowDoc version 2.4.1 allows remote attackers to obtain sensitive information by manipulating the page_id parameter. This vulnerability can lead to unauthorized access to note content and the discovery of usernames in the JSON data at a different URL.
Vulnerability Detail
The vulnerability in ShowDoc version 2.4.1 arises from a lack of proper input validation and access control. By modifying the page_id parameter, an attacker can bypass the intended restrictions and access sensitive information. This can have various ramifications, including unauthorized disclosure of confidential data and potential compromise of user accounts. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually validate and sanitize the page_id parameter before processing it. This can be done by implementing server-side checks and ensuring that the requested page_id is within the expected range of valid values. However, this workaround is not a comprehensive solution and should be considered temporary until the system is updated to a patched version.
Conclusion
In conclusion, ShowDoc version 2.4.1 is vulnerable to forced browsing, allowing remote attackers to access sensitive information. It is crucial to update to a patched version and implement proper input validation and access control mechanisms to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for showdoc/showdoc →
FAQ
ShowDoc is a package available on Packagist that provides functionality for creating and managing documentation.
The vulnerability allows remote attackers to obtain sensitive information, potentially leading to unauthorized disclosure of confidential data and compromise of user accounts.
To fix this vulnerability, it is recommended to upgrade to a patched version of ShowDoc and implement proper input validation and access control mechanisms.
Yes, users can manually validate and sanitize the page_id parameter before processing it as a temporary workaround.
The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for showdoc/showdoc.
