CVE-2024-35184

Published: May 15, 2024Modified: Jun 17, 2026Deferred

5.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Exploitability: 2.1 / Impact: 3.4

Source: security-advisories@github.com (Secondary)

Description

Paperless-ngx is a document management system that transforms physical documents into a searchable online archive. Starting in version 2.5.0 and prior to version 2.8.6, remote user authentication allows API access even if API access is explicitly disabled. Version 2.8.6 contains a patchc for the issue.

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (8)

https://github.com/paperless-ngx/paperless-ngx/commit/ed05b40ba461641b1b59b0a92f51f3f6a66ce180

Source: security-advisories@github.com

https://github.com/paperless-ngx/paperless-ngx/pull/6739

Source: security-advisories@github.com

https://github.com/paperless-ngx/paperless-ngx/releases/tag/v2.8.6

Source: security-advisories@github.com

https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-72w4-hxqq-c256

Source: security-advisories@github.com

https://github.com/paperless-ngx/paperless-ngx/commit/ed05b40ba461641b1b59b0a92f51f3f6a66ce180

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/paperless-ngx/paperless-ngx/pull/6739

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/paperless-ngx/paperless-ngx/releases/tag/v2.8.6

Source: af854a3a-2127-422b-91ae-364da2661108

https://github.com/paperless-ngx/paperless-ngx/security/advisories/GHSA-72w4-hxqq-c256

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.