CVE-2024-27292CWE-706

Docassemble unauthorized access through URL manipulation

High · published February 29, 2024

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.4th percentile for exploit probability.

CVSS v3.1

7.5

EPSS

69%

Percentile

99.4

In the wild

Unconfirmed

What it is

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the master branch.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.69486 · 99.4th percentile
Weakness: CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published: 2024-02-29T21:56Z

EPSS history

Timeline

29 FEB 21:56Z
Docassemble unauthorized access through URL manipulation
cvelistv5