Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.1
CVE-2021-20736: NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.
CVE-2021-20736 · published 5 years ago
Summary
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.
What to do
- Update weseek growi to version 4.2.20 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| weseek | growi |
< 4.2.20 cpe:2.3:a:weseek:growi:*:*:*:*:*:*:*:* |
Original advisory text
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.
NoSQL injection vulnerability in GROWI versions prior to v4.2.20 allows a remote attacker to obtain and/or alter the information stored in the database via unspecified vectors.
References
- https://jvn.jp/en/jp/JVN95457785/index.html Third Party Advisory
- https://weseek.co.jp/security/2021/06/14/vulnerability/growi-nosql-ingection/ Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-74Injection
Timeline
Published22 Jun 2021
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2021-20736 · NVD
Track software like this
Free during beta