VulnerableCode Package Details - pkg:pypi/invenio-app-rdm@2.0.0.dev2

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:pypi/invenio-app-rdm@2.0.0.dev2

Essentials
History (1)

purl	pkg:pypi/invenio-app-rdm@2.0.0.dev2

Next non-vulnerable version	6.0.5
Latest non-vulnerable version	7.0.0.dev5
Risk

Vulnerabilities affecting this package (1)

Vulnerability	Summary	Fixed by
VCID-f9gz-r61j-8fgt Aliases: CVE-2021-43781 GHSA-xr38-w74q-r8jv PYSEC-2021-836 PYSEC-2021-837 PYSEC-2021-838	Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. cannot change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.	6.0.5 Affected by 0 other vulnerabilities. 7.0.0.dev5 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-f9gz-r61j-8fgt
Aliases:
CVE-2021-43781
GHSA-xr38-w74q-r8jv
PYSEC-2021-836
PYSEC-2021-837
PYSEC-2021-838

Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

6.0.5
Affected by 0 other vulnerabilities.

7.0.0.dev5
Affected by 0 other vulnerabilities.

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-02T04:16:07.838167+00:00	Pypa Importer	Affected by	VCID-f9gz-r61j-8fgt	https://github.com/pypa/advisory-database/blob/main/vulns/invenio-app-rdm/PYSEC-2021-837.yaml	38.6.0