Siga
Monthly
Missing authorization in projeto-siga Siga's authentication controller allows unauthenticated remote attackers to bypass access controls by manipulating the `cod` or `jwt` parameters submitted to the `ExAutenticacaoController.autenticar` function. Versions up to 11.0.2.10, 11.0.2.13, and 11.1.1 of this Brazilian judicial document management platform are affected. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure at time of analysis.
Server-side request forgery in projeto-siga SIGA up to version 11.1.1 allows unauthenticated remote attackers to cause the application server to issue arbitrary HTTP requests by supplying a crafted value to the html parameter of the HTML-to-PDF conversion endpoint (ExUtilController.java, DownloadExterno.getUrl). This enables attackers to probe internal network services, exfiltrate cloud metadata, or reach otherwise-inaccessible infrastructure through the server's outbound network position. A public exploit exists and the maintainer has not responded to the responsible disclosure issue (#2492), leaving all deployments on 11.1.1 and earlier unpatched.
Stored cross-site scripting (XSS) in projeto-siga SIGA 11.0.3.18 allows authenticated remote attackers to inject malicious scripts via the Nome/Descrição parameter in the /sigawf/app/responsavel/novo endpoint. Successful exploitation requires user interaction (UI:R) and an authenticated session (PR:L), limiting impact to information disclosure (I:L). Public exploit code is available, though exploitation remains constrained by authentication and user interaction requirements.
Missing authorization in projeto-siga Siga's authentication controller allows unauthenticated remote attackers to bypass access controls by manipulating the `cod` or `jwt` parameters submitted to the `ExAutenticacaoController.autenticar` function. Versions up to 11.0.2.10, 11.0.2.13, and 11.1.1 of this Brazilian judicial document management platform are affected. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the vendor has not responded to the responsible disclosure at time of analysis.
Server-side request forgery in projeto-siga SIGA up to version 11.1.1 allows unauthenticated remote attackers to cause the application server to issue arbitrary HTTP requests by supplying a crafted value to the html parameter of the HTML-to-PDF conversion endpoint (ExUtilController.java, DownloadExterno.getUrl). This enables attackers to probe internal network services, exfiltrate cloud metadata, or reach otherwise-inaccessible infrastructure through the server's outbound network position. A public exploit exists and the maintainer has not responded to the responsible disclosure issue (#2492), leaving all deployments on 11.1.1 and earlier unpatched.
Stored cross-site scripting (XSS) in projeto-siga SIGA 11.0.3.18 allows authenticated remote attackers to inject malicious scripts via the Nome/Descrição parameter in the /sigawf/app/responsavel/novo endpoint. Successful exploitation requires user interaction (UI:R) and an authenticated session (PR:L), limiting impact to information disclosure (I:L). Public exploit code is available, though exploitation remains constrained by authentication and user interaction requirements.