CVE-2021-43781

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862 CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Dec 6, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-437827.2Tuleap is a Libre and Open Source tool for end to end traceability of application and system developments. This is a follow up to GHSA-887w-CVE-2021-437838.5@backstage/plugin-scaffolder-backend is the backend for the default Backstage software templates. In affected versions a malicious actor wit CVE-2021-437845.0runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a CVE-2021-437856.1@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL f CVE-2021-437867.5Nodebb is an open source Node.js based forum software. In affected versions incorrect logic present in the token verification step unintenti CVE-2021-437876.1Nodebb is an open source Node.js based forum software. In affected versions a prototype pollution vulnerability in the uploader module allow CVE-2021-437885.0Nodebb is an open source Node.js based forum software. Prior to v1.18.5, a path traversal vulnerability was present that allowed users to ac CVE-2021-437899.8PrestaShop is an Open Source e-commerce web application. Versions of PrestaShop prior to 1.7.8.2 are vulnerable to blind SQL injection using CVE-2021-43796.5The WooCommerce Multi Currency plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wmc_bulk_CVE-2021-437908.1Lucet is a native WebAssembly compiler and runtime. There is a bug in the main branch of `lucet-runtime` affecting all versions published to CVE-2021-437915.3Zulip is an open source group chat application that combines real-time chat with threaded conversations. In affected versions expiration dat CVE-2021-437924.3Discourse is an open source discussion platform. In affected versions a vulnerability affects users of tag groups who use the "Tags are visi