Detections
Analytics

SCA: security update for invenio-app-rdm, invenio-drafts-resources, invenio-rdm-records (GHSA-xr38-w74q-r8jv)

medium Tenable Self-Hosted Container Security Plugin ID 420633

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research
 data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check
 permissions when a record is published. The vulnerability is exploitable in a default installation of
 InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if
 they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker
 is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to
 public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM
 v6.0.1 and InvenioRDM v7.0 respectively. (CVE-2021-43781)

See Also

https://github.com/advisories/GHSA-xr38-w74q-r8jv

Plugin Details

Severity: Medium

ID: 420633

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 1/28/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 4

Temporal Score: 3.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS Score Source: CVE-2021-43781

CVSS v3

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 5.1

Threat Score: 1.2

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/6/2021

Vulnerability Publication Date: 12/6/2021

Reference Information

CVE: CVE-2021-43781