Description

Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.

Related CPE's

Could not find any relations

References

https://github.com/BookStackApp/BookStack/issues/4993

https://github.com/BookStackApp/BookStack/releases/tag/v24.05.1

https://www.bookstackapp.com/blog/bookstack-release-v24-05-1/

https://github.com/BookStackApp/BookStack/issues/4993

https://github.com/BookStackApp/BookStack/releases/tag/v24.05.1

https://www.bookstackapp.com/blog/bookstack-release-v24-05-1/

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-79

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 · High

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2024-07-09T22:15:02.467Z

2 years ago

Last modified

2026-06-17T07:37:05.583Z

4 months ago