SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can d…
中危 CVSS 5.8
摘要
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password.
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
数据来源
- NVD DATABASE
原始链接
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-vg99-7gj7-2fr5
- https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getrefids
时间线
- nvd_ingest NVD