References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Known Affected Software Configurations Switch to CPE 2.2

Change History

NIST AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

OR
     *cpe:2.3:a:erudika:scoold:*:*:*:*:*:*:*:* versions up to (including) 1.64.0

https://github.com/Erudika/scoold/security/advisories/GHSA-fhwp-f6g7-rr3p No Types Assigned

https://github.com/Erudika/scoold/security/advisories/GHSA-fhwp-f6g7-rr3p Vendor Advisory

Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT requests on the /api;/config endpoint while setting the Content-Type: application/hocon header allow unauthenticated attackers to file reading via HOCON file inclusion. This allows attackers to retrieve sens

GitHub, Inc. CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

GitHub, Inc. CWE-288

GitHub, Inc. https://github.com/Erudika/scoold/security/advisories/GHSA-fhwp-f6g7-rr3p [No types assigned]