Vulnerability feed

Executive summary

The advisory describes a fix in the Goobi viewer web application's IIIF authorization code, where unvalidated origin values could be reflected into a script block. The text does not state a severity rating, affected version range, or fixed version, and it does not give a clear recommended action beyond the code change shown.

Technical summary

The change adds strict validation of the origin parameter against a pattern for scheme://host[:port] and rejects invalid values with HTTP 400 in the login and token services. It also adds an escaping function for origin values written into a JavaScript string inside a script tag in the token service response, which suggests a script injection or breakout weakness, though the advisory text does not explicitly name a vulnerability class, CVE-specific attack vector, or required preconditions. Affected versions are not stated, fixed versions are not stated, and no workaround or detection guidance is provided in the advisory text.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…7dfe3958ad2bbcff2d0b

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Changed

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer

Executive summary

The advisory describes a set of code changes to the Goobi viewer, a web application for displaying digitised material. The changes address several issues, including Solr query injection risks on the spatial search endpoint and a deprecated token-in-URL authentication path. The advisory text does not state a severity rating, and it does not say whether these changes correspond to a specific exploitable vulnerability with a CVSS score.

Technical summary

The diff shows several hardening changes: a deprecated fallback that accepts the web API token as a URL query parameter (logged as a warning, removal planned on or after 2027-05-28), input validation on the solrField and region parameters of the spatial search endpoint to block Solr query syntax, and passing filterQuery through SolrTools.cleanUpQuery to strip Solr local-params. The buildClearCacheUrl method was changed to stop placing the token in the URL and the caller now sends it as a header. The advisory does not state the vulnerability class, the attack preconditions, affected versions, fixed versions, or a CVSS score. No workaround or detection guidance beyond the WARN log message is stated. The commit references GVC-2026-17 and GVC-2026-20, which the advisory does not further describe.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…c387e5a0d0d3875bf633

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer

Executive summary

The advisory describes a change to the Goobi viewer web application that adds origin checks and authorization checks to several WebSocket endpoints, which are the parts of the software that handle live connections from browsers. The advisory does not state a severity rating, a CVSS score, or whether the issue has been exploited. The vendor's recommendation is not stated in the text provided.

Technical summary

The advisory is a code diff rather than a conventional vulnerability description, and it does not state a vulnerability class, CVSS score, or affected or fixed version numbers. The changes add an Origin header check (intended to guard against cross-site WebSocket hijacking) that is off by default and enabled through a new configuration setting, and add user authentication and campaign permission checks to WebSocket endpoints such as CampaignEndpoint, DownloadTaskEndpoint, LogViewerEndpoint, and UserEndpoint. The advisory does not state the attack vector, the preconditions for exploitation, or any workaround beyond enabling the new setting. It does not state the affected versions, the fixed versions, or any detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…4a1ee6753de65cbe3412

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer

Executive summary

The advisory describes a fix in the Goobi viewer web application's OpenID login handling, where the login token checks were not strict enough. The advisory does not state a severity rating or any exploitation details, and it does not name a fixed release version.

Technical summary

The change addresses weak validation of OpenID Connect ID tokens in the authentication endpoint. The previous code compared the nonce only when present and checked the audience claim outside the token verifier, which allowed possible cross-relying-party token replay. The patch passes the client ID into verifyOpenIdToken, requires audience, exp and iat claims to be present, adds a 60 second acceptance leeway, and rejects missing session or token nonces. The advisory does not state the vulnerability class by name, the CVSS score, affected or fixed version numbers, workarounds, or detection guidance, and these are not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…d21644592efd6cf87933

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer

Executive summary

The advisory describes a change to the Goobi viewer, a web application for displaying digitised material, that fixes how REST API access is authorized. The text provided is a code diff rather than a full vulnerability description, so the severity and impact are not stated. The advisory does not state a vendor recommendation beyond the code change itself.

Technical summary

The diff changes the AuthorizationFilter checkPermissions method so that when the configured webapi.authorization.token is blank, REST API access is rejected, and blank supplied tokens are rejected before comparison. The comparison still uses MessageDigest.isEqual for constant-time comparison. The advisory does not name a CVE-specific vulnerability class, attack vector, affected version range, fixed version number, CVSS score, workaround, or exploitation status. Those details are not stated in the provided text. The diff adds unit tests covering empty tokens and empty configured tokens, but gives no detection guidance.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…b440871b50181f04716d

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer

Executive summary

The advisory describes a flaw in the Goobi viewer web application, a tool for displaying digitised material in a browser, in its RSS feed handling. The text is a code diff of a fix to the RssResolver servlet, and it does not state how severe the issue is or give a CVSS score. The change is presented as a fix, and the advisory does not state any version numbers or other steps for administrators.

Technical summary

The diff suggests the weakness is an access-control bypass in the RSS servlet, where access-condition text was concatenated onto the user query so boolean operators in the q parameter could make the access restriction optional. The fix passes the access suffix as a separate filter query instead. The advisory does not state the vulnerability class, the attack preconditions, affected versions, fixed versions, workarounds, or any detection guidance. Those details are not stated in the text provided.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…ea236be0d86e08948f6b

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer

Executive summary

The advisory describes a fix in the Goobi viewer, a web application for displaying digitised material in a browser. The flaw concerns how search query strings are cleaned up, which could let crafted input change search behaviour and return far more records than intended. The advisory text shown does not state a severity rating or a fixed release version.

Technical summary

The change rewrites the cleanUpQuery method in SolrTools.java to replace a greedy brace-stripping regex with a placeholder-based approach that keeps a whitelist of internal Solr local parameters (join and terms) and strips other brace-delimited blocks, including double-wrapped injections. The prior regex is described as stripping inner closing braces and producing a near-match-all query that returned roughly the entire index. The vulnerability class appears to be Solr query injection through local parameters; the attack vector and preconditions are not explicitly stated in the advisory text. Affected and fixed version numbers are not stated, and no CVSS score, workaround, or detection guidance is given. Added unit tests cover stripping of single and double brace local parameters, graph and function query injection, and retention of the terms parameter.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…a46b98bb9b6a88748a4e

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer

Executive summary

The advisory describes a fix in the Goobi viewer web application for externally downloaded files and resource URLs. The diff adds checks that block non-HTTP(S) schemes and private network addresses, which addresses a server-side request forgery style risk. The advisory text does not state a severity rating, and it does not explicitly describe a vendor recommendation beyond the code change.

Technical summary

The changes add scheme validation (only http and https are accepted) and a call to NetTools.validateOutboundUrl before downloads and existence checks in ExternalFilesDownloader, which points to an SSRF class of issue. Attack preconditions, the exact vulnerability description, and affected versions are not stated in the text. Fixed version numbers are not stated, and no CVSS score, workaround, or detection guidance is provided. The diff also gates external resource URL templates behind a new externalResource[@enabled] configuration flag and includes a filename sanitization change for Content-Disposition headers.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…b42492fbb8af731a2ce5

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer

Executive summary

The advisory describes a fix in the Goobi viewer web application that addresses server-side request forgery in its external file download feature, where the application could be made to fetch resources from unintended addresses. The advisory's diff shows changes to restrict download schemes and block private network addresses, but it does not state a severity rating. The advisory does not state what version contains the fix or give a recommendation beyond the code changes shown.

Technical summary

The diff indicates the flaw relates to server-side request forgery in the external file downloader, which previously accepted file scheme URIs and did not appear to validate destination addresses. The patch restricts downloads to http and https, calls a NetTools outbound URL validation that rejects private network addresses, and builds HTTP clients through a URL-aware helper. The advisory's text does not state the attack vector details, preconditions, affected version ranges, fixed version numbers, CVSS score, workarounds, or exploitation status, and these are not stated. The diff also changes a configuration check so external resource URL templates are only used when the externalResource enabled setting is true, and it removes a pom.xml SNAPSHOT dependency version.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…b42492fbb8af731a2ce5

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer

Executive summary

The advisory describes a flaw in the Goobi viewer, a web application for displaying digitised material in a browser. The diff shows the password reset process previously generated reset tokens and new passwords from the system time, which could be predictable. The advisory text does not state a severity rating, and it does not state a vendor recommendation beyond the code change shown.

Technical summary

The fix replaces predictable password reset values, previously derived from System.currentTimeMillis() through StringTools.generateHash, with values from java.security.SecureRandom in UserBean.java. The activation key used for password reset is now 32 random bytes hex encoded, and the new password is now 4 random bytes hex encoded, which is 8 hex characters. The vulnerability class, attack preconditions, CVSS score, affected version range, fixed version number, workarounds, and exploitation status are not stated in the advisory. Detection guidance is not stated.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…aa0bd5a68173cd446eef

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer

Executive summary

The advisory describes a fix in the Goobi viewer, a web application for displaying digitised material, where password reset tokens and new passwords were generated from the system time. The text is a code diff and does not state a severity rating or a vulnerability description, and it does not state a CVSS score.

Technical summary

The diff changes UserBean.java so that the password reset activation key is built from 32 bytes of java.security.SecureRandom output instead of a hash of System.currentTimeMillis(). It also replaces the 8-character new password, previously derived from the same timestamp hash, with 4 random bytes encoded as hex. The advisory does not state the vulnerability class, attack preconditions, affected versions, fixed version numbers, workarounds, or detection guidance, and it does not state whether exploitation has occurred. The text names no affected product versions beyond the Goobi viewer project itself.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from github.com/intranda/goobi-viewer-core/c…aa0bd5a68173cd446eef

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affects

intrandaGoobiintranda goobi-viewer-coreGoobi viewer