changedetection.io@0.39.18 vulnerabilities

changedetection.io is a Website change detection and monitoring service

Affected versions of this package are vulnerable to Directory Traversal due to improper validation for the file URI scheme. An attacker can read any file on the system by crafting a URL that bypasses the intended restrictions on local file access.

Note: This issue only affects instances with a webdriver enabled, and ALLOW_FILE_URI false or not defined.

Upgrade changedetection.io to version 0.47.6 or higher.

changedetection.io is a Website change detection and monitoring service

Affected versions of this package are vulnerable to Directory Traversal via the Watch.py and __init__.py files, an attacker can read arbitrary files on the system by manipulating the file URL to bypass security checks designed to block traditional file access methods.

Upgrade changedetection.io to version 0.47.5 or higher.

changedetection.io is a Website change detection and monitoring service

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) due to improper sanitization of user input in the notification_urls parameter. An attacker can inject malicious scripts into the web page, which are executed in the context of the user's browser session when the malicious URL is visited, or malicious POST data is submitted.

Upgrade changedetection.io to version 0.45.22 or higher.

changedetection.io is a Website change detection and monitoring service

Affected versions of this package are vulnerable to Server-Side Template Injection due to improper handling of template data. An attacker can execute arbitrary commands on the server by crafting malicious input that exploits the template rendering process.

Notes:

1. This can be reduced if changedetection access is protected by login page with a password, but this isn't required by the application (not by default and not enforced).

2)This vulnerability is particularly severe as it allows for complete server takeover without any restrictions, such as running a reverse shell.

Upgrade changedetection.io to version 0.45.21 or higher.

changedetection.io is a Website change detection and monitoring service

Affected versions of this package are vulnerable to Incorrect Authorization via the API endpoint /api/v1/watch/<uuid>/history. An attacker can access watch history information without proper authorization by knowing a watch UUID. Although the exposed data is limited to paths to snapshots on the server, it could lead to a minimal impact on user data privacy.

Upgrade changedetection.io to version 0.45.13 or higher.