Blossom
Monthly
An authenticated authorization bypass (IDOR) in Blossom through 1.17.1 lets any registered user act on folders belonging to other users by supplying a foreign folder id to the /folder/info, /folder/upd, /folder/open or /folder/del endpoints, exposing storage paths, enabling renames, visibility toggling and deletion. Exploitation requires a valid account on a multi-user instance (PR:L, per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) plus knowledge of a victim's folder id; single-user deployments have no cross-user victim. The result is a medium-severity integrity and confidentiality issue scoped to folder metadata rather than a critical remote compromise, and no public working exploit code was identified at time of analysis, though a public technical write-up reference exists.
Blossom through 1.17.1 fails to verify picture ownership on its picture delete, /picture/del/batch and /picture/star endpoints, so an authenticated user with non-readonly privileges can pass arbitrary picture ids belonging to other accounts and permanently delete their images and stored files or flip their star status. The flaw is a classic IDOR (CWE-639) rated 5.3 by the reporter and re-scored as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L in independent assessment: exploitation needs a valid non-readonly login plus a multi-user instance holding other users' pictures, and impact is bounded to integrity and availability of picture records - no data disclosure. There is no CISA KEV confirmation of active exploitation; a public technical writeup reference exists but is not verified as working exploit code, and the priority label places remediation within this month rather than as an emergency.
Path traversal in Blossom up to version 1.17.1 file upload functionality allows authenticated remote attackers to access arbitrary files on affected systems. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.
A vulnerability was detected in Blossom up to 1.17.1. This vulnerability affects the function content of the file blossom-backend/backend/src/main/java/com/blossom/backend/server/article/draft/ArticleController.java of the component Article Title Handler. [CVSS 3.5 LOW]
An authenticated authorization bypass (IDOR) in Blossom through 1.17.1 lets any registered user act on folders belonging to other users by supplying a foreign folder id to the /folder/info, /folder/upd, /folder/open or /folder/del endpoints, exposing storage paths, enabling renames, visibility toggling and deletion. Exploitation requires a valid account on a multi-user instance (PR:L, per the assessed CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) plus knowledge of a victim's folder id; single-user deployments have no cross-user victim. The result is a medium-severity integrity and confidentiality issue scoped to folder metadata rather than a critical remote compromise, and no public working exploit code was identified at time of analysis, though a public technical write-up reference exists.
Blossom through 1.17.1 fails to verify picture ownership on its picture delete, /picture/del/batch and /picture/star endpoints, so an authenticated user with non-readonly privileges can pass arbitrary picture ids belonging to other accounts and permanently delete their images and stored files or flip their star status. The flaw is a classic IDOR (CWE-639) rated 5.3 by the reporter and re-scored as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L in independent assessment: exploitation needs a valid non-readonly login plus a multi-user instance holding other users' pictures, and impact is bounded to integrity and availability of picture records - no data disclosure. There is no CISA KEV confirmation of active exploitation; a public technical writeup reference exists but is not verified as working exploit code, and the priority label places remediation within this month rather than as an emergency.
Path traversal in Blossom up to version 1.17.1 file upload functionality allows authenticated remote attackers to access arbitrary files on affected systems. Public exploit code exists for this vulnerability, and no patch is currently available from the vendor despite early notification.
A vulnerability was detected in Blossom up to 1.17.1. This vulnerability affects the function content of the file blossom-backend/backend/src/main/java/com/blossom/backend/server/article/draft/ArticleController.java of the component Article Title Handler. [CVSS 3.5 LOW]