Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/519527?format=api",
    "purl": "pkg:pypi/docassemble@0.2.68",
    "type": "pypi",
    "namespace": "",
    "name": "docassemble",
    "version": "0.2.68",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": true,
    "next_non_vulnerable_version": "1.2.65",
    "latest_non_vulnerable_version": "1.2.65",
    "affected_by_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54455?format=api",
            "vulnerability_id": "VCID-p42t-rxmt-6yde",
            "summary": "Unauthorized access through URL manipulation\n### Impact\nThe vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation.\n\n### Patches\nThe vulnerability has been patched of the `master` branch of the series, of the `stable` branch. The Docker image on docker.io has been patched.\n\n### Workarounds\nIf upgrading is not possible, manually apply the changes of https://github.com/jhpyle/docassemble/commit/e3dbf6ce054b3c0310996f0657289f5eed0a73fe and restart the server (e.g., by pressing Save on the Configuration screen).\n\n### Credit\nThe vulnerability was discovered by Jim Platania of Seiso LLC (@jimmio).\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [docassemble](https://github.com/jhpyle/docassemble/issues)\n* Join the [Slack channel](https://join.slack.com/t/docassemble/shared_invite/zt-ohrn8y9z-_Fb3RAl~JPBU6Km7odBPfQ)\n* Email us at [jhpyle@gmail.com](mailto:jhpyle@gmail.com)",
            "references": [
                {
                    "reference_url": "https://github.com/advisories/GHSA-qrmm-w4v4-q7f8",
                    "reference_id": "GHSA-qrmm-w4v4-q7f8",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "HIGH",
                            "scoring_system": "cvssv3.1_qr",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://github.com/advisories/GHSA-qrmm-w4v4-q7f8"
                },
                {
                    "reference_url": "https://github.com/jhpyle/docassemble/security/advisories/GHSA-qrmm-w4v4-q7f8",
                    "reference_id": "GHSA-qrmm-w4v4-q7f8",
                    "reference_type": "",
                    "scores": [
                        {
                            "value": "HIGH",
                            "scoring_system": "cvssv3.1_qr",
                            "scoring_elements": ""
                        },
                        {
                            "value": "HIGH",
                            "scoring_system": "generic_textual",
                            "scoring_elements": ""
                        }
                    ],
                    "url": "https://github.com/jhpyle/docassemble/security/advisories/GHSA-qrmm-w4v4-q7f8"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/80664?format=api",
                    "purl": "pkg:pypi/docassemble@1.2.65",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/docassemble@1.2.65"
                }
            ],
            "aliases": [
                "GHSA-qrmm-w4v4-q7f8",
                "GMS-2021-9"
            ],
            "risk_score": 4.0,
            "exploitability": "0.5",
            "weighted_severity": "8.0",
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p42t-rxmt-6yde"
        }
    ],
    "fixing_vulnerabilities": [],
    "risk_score": "4.0",
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/docassemble@0.2.68"
}