Description
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 24.03 to before version 26.05, the DownloadTaskEndpoint WebSocket endpoint (/tasks/download/monitor.socket) in goobi-viewer-core accepts download requests from unauthenticated users. This issue has been patched in version 26.05.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
intranda goobi-viewer-core
>= 24.03, < 26.05affected
References
- https://github.com/intranda/goobi-viewer-core/security/advisories/GHSA-79jg-3m2m-jgc8 ↗
- https://github.com/intranda/goobi-viewer-core/commit/5281245708447ae3419cb42492fbb8af731a2ce5 ↗
- https://github.com/intranda/goobi-viewer-core/commit/b8943ee963e2aa1131da2212eaf85c5a2d90214f ↗
- https://github.com/intranda/goobi-viewer-core/releases/tag/v26.05 ↗