Docs
Monthly
Code injection in the Salty Docs documentation build pipeline (saltyorg/docs) lets an attacker-controlled fork pull request execute arbitrary code in the privileged base-repository GitHub Actions workflow that has repository secrets in scope, resulting in disclosure of CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY and a write-capable GITHUB_TOKEN and enabling follow-on compromise of the docs.saltbox.dev deployment. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0) and, per the independent assessment, exploitation is confined to repositories running this specific pre-fix workflow pair - the trigger-pr-build.yml workflow records an untrusted fork commit SHA in the pr_info artifact and build-pr.yml's workflow_run job checks that SHA out before running 'pip install -r requirements.txt'. No public exploit code identified at time of analysis and the issue is not in CISA KEV, but the code path is a genuine CI/CD supply-chain flaw rather than a CVSS-inflated paper risk, so the risk is high for unpatched users of this template. Practical exploitation still requires an attacker to control fork content (malicious setup.py or PEP 517 build hook) rather than merely tampering with artifact metadata, and submitting a fork PR requires a GitHub account even though the vector scores PR:N.
Revoked users of suitenumerique Docs prior to 5.4.1 can retain real-time read and write access to nested sub-documents, because the server resets collaboration websocket rooms only for the document whose permissions changed and not for its descendants. An attacker who is a previously authorized user (authenticated, PR:L per the CVSS vector) and who already holds an open websocket session to a sub-document keeps that session alive after their access is revoked at the parent level, allowing continued viewing and editing of content they should no longer reach; the impact is bounded by the requirement that a live session already exist at the moment of revocation (AC:H, AT:P), and no KEV-listed active exploitation has been reported, though publicly available exploit code exists. This is an offboarding and session-expiration failure (CWE-613) rather than an unauthenticated intrusion vector, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) aligns with the high confidentiality and integrity impact described.
Stored XSS in LaSuite Doc versions 3.8.0 through 4.3.0 allows authenticated users with document editing privileges to inject malicious JavaScript URLs into the Interlinking feature, which execute when other users click the crafted links. This vulnerability affects the collaborative documentation platform's security model by enabling arbitrary code execution in victims' browsers. A patch is available in version 4.4.0.
An authorization bypass in La Suite Docs through 6.0.0 allows a user with COMMENTER-level access to any document they control to insert comments into a thread belonging to a different, inaccessible document by naming their own document in the request path and supplying the victim thread's UUID. The attack requires prior knowledge of a valid thread UUID, which is not enumerable and must be leaked or observed, so although this is a genuine IDOR (CWE-639) the practical impact is limited to comment injection with no read access to the victim document's contents. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in versions after 6.0.0 (GitHub PR #2838).
Unauthenticated enumeration of document metadata in LaSuite Doc (suitenumerique/docs) versions 4.8.2 up to but not including 5.4.0, via the GET /api/v1.0/documents/search/ endpoint that accepts a predictable seven-digit 'path' value to scope descendant searches. Because the endpoint does not require the caller to know a document's public UUID, a remote unauthenticated attacker can submit an empty search query and iterate path values to harvest document identifiers, titles, creator data, timestamps and tree metadata for public documents, then feed the disclosed identifiers into normal public-document endpoints to read the content; authenticated users can likewise reach documents shared via authenticated links, while restricted documents remain protected. Severity is moderate and confidentiality-only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires no special conditions or authentication (CVSS vector PR:N), no public exploit code was identified at time of analysis, and the issue is fixed in version 5.4.0. This is a genuine but moderate-severity information-disclosure issue, not a critical one.
Unauthenticated server-side request forgery in Suite Numérique Docs through 5.6.1 allows any anonymous attacker who knows a public document UUID to make the application's cors-proxy endpoint issue outbound HTTP requests to arbitrary hosts, including internal network resources. By abusing DNS time-of-check-time-of-use race conditions and shared address-space bypasses, an attacker can reach internal services and exfiltrate image content that the proxy fetches on their behalf. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and the confidentiality impact is assessed as limited, so this is a moderate-priority SSRF rather than a catastrophic one — but open, unauthenticated Docs instances should be treated as internet-facing proxies into their own networks until patched.
Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Code injection in the Salty Docs documentation build pipeline (saltyorg/docs) lets an attacker-controlled fork pull request execute arbitrary code in the privileged base-repository GitHub Actions workflow that has repository secrets in scope, resulting in disclosure of CF_API_TOKEN, GH_TOKEN, MKDOCS_GIT_COMMITTERS_APIKEY and a write-capable GITHUB_TOKEN and enabling follow-on compromise of the docs.saltbox.dev deployment. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (10.0) and, per the independent assessment, exploitation is confined to repositories running this specific pre-fix workflow pair - the trigger-pr-build.yml workflow records an untrusted fork commit SHA in the pr_info artifact and build-pr.yml's workflow_run job checks that SHA out before running 'pip install -r requirements.txt'. No public exploit code identified at time of analysis and the issue is not in CISA KEV, but the code path is a genuine CI/CD supply-chain flaw rather than a CVSS-inflated paper risk, so the risk is high for unpatched users of this template. Practical exploitation still requires an attacker to control fork content (malicious setup.py or PEP 517 build hook) rather than merely tampering with artifact metadata, and submitting a fork PR requires a GitHub account even though the vector scores PR:N.
Revoked users of suitenumerique Docs prior to 5.4.1 can retain real-time read and write access to nested sub-documents, because the server resets collaboration websocket rooms only for the document whose permissions changed and not for its descendants. An attacker who is a previously authorized user (authenticated, PR:L per the CVSS vector) and who already holds an open websocket session to a sub-document keeps that session alive after their access is revoked at the parent level, allowing continued viewing and editing of content they should no longer reach; the impact is bounded by the requirement that a live session already exist at the moment of revocation (AC:H, AT:P), and no KEV-listed active exploitation has been reported, though publicly available exploit code exists. This is an offboarding and session-expiration failure (CWE-613) rather than an unauthenticated intrusion vector, and the assessed CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) aligns with the high confidentiality and integrity impact described.
Stored XSS in LaSuite Doc versions 3.8.0 through 4.3.0 allows authenticated users with document editing privileges to inject malicious JavaScript URLs into the Interlinking feature, which execute when other users click the crafted links. This vulnerability affects the collaborative documentation platform's security model by enabling arbitrary code execution in victims' browsers. A patch is available in version 4.4.0.
An authorization bypass in La Suite Docs through 6.0.0 allows a user with COMMENTER-level access to any document they control to insert comments into a thread belonging to a different, inaccessible document by naming their own document in the request path and supplying the victim thread's UUID. The attack requires prior knowledge of a valid thread UUID, which is not enumerable and must be leaked or observed, so although this is a genuine IDOR (CWE-639) the practical impact is limited to comment injection with no read access to the victim document's contents. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fix in versions after 6.0.0 (GitHub PR #2838).
Unauthenticated enumeration of document metadata in LaSuite Doc (suitenumerique/docs) versions 4.8.2 up to but not including 5.4.0, via the GET /api/v1.0/documents/search/ endpoint that accepts a predictable seven-digit 'path' value to scope descendant searches. Because the endpoint does not require the caller to know a document's public UUID, a remote unauthenticated attacker can submit an empty search query and iterate path values to harvest document identifiers, titles, creator data, timestamps and tree metadata for public documents, then feed the disclosed identifiers into normal public-document endpoints to read the content; authenticated users can likewise reach documents shared via authenticated links, while restricted documents remain protected. Severity is moderate and confidentiality-only (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), exploitation requires no special conditions or authentication (CVSS vector PR:N), no public exploit code was identified at time of analysis, and the issue is fixed in version 5.4.0. This is a genuine but moderate-severity information-disclosure issue, not a critical one.
Unauthenticated server-side request forgery in Suite Numérique Docs through 5.6.1 allows any anonymous attacker who knows a public document UUID to make the application's cors-proxy endpoint issue outbound HTTP requests to arbitrary hosts, including internal network resources. By abusing DNS time-of-check-time-of-use race conditions and shared address-space bypasses, an attacker can reach internal services and exfiltrate image content that the proxy fetches on their behalf. No public exploit code or CISA KEV entry is associated with this issue at time of analysis, and the confidentiality impact is assessed as limited, so this is a moderate-priority SSRF rather than a catastrophic one — but open, unauthenticated Docs instances should be treated as internet-facing proxies into their own networks until patched.
Tencent Docs Desktop 3.9.20 and earlier suffers from Missing SSL Certificate Validation in the update component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.