SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline stat…
Medium CVSS 5.8
Summary
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester.
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/siyuan-note/siyuan/security/advisories/GHSA-53fp-9jmv-227g
- https://www.vulncheck.com/advisories/siyuan-before-information-disclosure-via-getoutlinestorage
Timeline
- nvd_ingest NVD