p PatchFirst

PatchFirst · Свежие уязвимости

Уязвимости inventree

За последние 30 дней в inventree опубликовано уязвимостей: 0; в каталоге KEV: 0.

RSS ↗ JSON ↗
Фильтры уязвимостей
Сбросить фильтры

Уязвимостей: 7

  1. GHSA-vx3h-qwqw-r2wq

    Средний · CVSS 5.3Есть исправление

    Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP

    ### Impact The "download image from remote URL" feature can be abused by a malicious actor to potentially extract information about server side resources. Submitting a crafted URL (in place of a valid image) can raise a server side error, which is reported back to the user. This error message may contain sensitive information about the server side request, including information about the availability of the remote resource. ### Patches The solution to this vulnerability is to prevent the server from returning any specific information about the observed exception. Instead, a generic error message is returned to the client. This patch has

    inventreePython
    • Обновитесь до 0.16.5
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  3. GHSA-85q9-7467-r53q

    Без оценкиЕсть исправление

    XSS Vulnerability in Markdown Editor

    ### Impact InvenTree uses [EasyMDE](https://github.com/Ionaru/easy-markdown-editor) for displaying markdown text in various places (e.g. for the various "notes" fields associated with various models). By default, EasyMDE does not sanitize input data, and it is possible for malicious code to be injected into the markdown editor, and executed in the users browser. *Note: This malicious data must be first uploaded to the database by an authorized user, so the risk here is limited to trusted users* ### Solution The solution here is two-fold: - Enable data sanitization for the EasyMDE renderer - [#3205](https://github.com/inventree/InvenTree

    inventreePython
    • Обновитесь до 0.7.3
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗

  4. CVE-2022-2112

    Критический · CVSS 9EPSS 1,3%Есть исправление

    Improper Neutralization of Formula Elements in a CSV File in inventree/inventree

    Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.

    inventreePython
    • Обновитесь до 0.7.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  5. CVE-2022-2111

    Критический · CVSS 9EPSS 1,26%Есть исправление

    Unrestricted Upload of File with Dangerous Type in inventree/inventree

    Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.

    inventreePython
    • Обновитесь до 0.7.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  6. GHSA-7rq4-qcpw-74gq

    Без оценкиЕсть исправление

    Formula Injection in Exported Data

    ### Impact Datasets exported to file (e.g. CSV / XLS) are not sufficiently sanitized, to neutralize potential formula injection ### Patches - The issue is addressed in the upcoming 0.8.0 release - This fix will also be back-ported to the 0.7.x branch, applied to the 0.7.2 release ### Workarounds Users exporting untrusted data should open the files in safe mode (e.g. in Microsoft Excel). ### References - https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73/ - https://owasp.org/www-community/attacks/CSV_Injection ### For more information If you have any questions or comments about this advisory: * Open an issue in [github](

    inventreePython
    • Обновитесь до 0.7.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

  7. GHSA-rm89-9g65-4ffr

    Без оценкиЕсть исправление

    Insufficient HTML Sanitization

    ### Impact Affected versions can have malicious javascript code injected into the users browser by other authenticated users, as data fields retrieved from the database are not properly sanitized before displaying in various front-end views. The problem here stems from multiple issues: - Insufficient database sanitation on multiple fields allows injection of un-sanitized HTML - Lack of HTML escaping when rendering data on the front end The attack vector here is limited, as only authenticated users are able to write data to the database, for it to be subsequently rendered on the front-end. However, it is a vulnerability that the InvenTree

    inventreePython
    • Обновитесь до 0.7.2
    Опубликовано Обновлено
    Исходное сообщение 1 ↗Исходное сообщение 2 ↗Исходное сообщение 3 ↗

Проверьте свой сервер

Сопоставьте установленный стек и версии со свежими базами уязвимостей.

Проверьте свой сервер →