projeto-siga siga vulnerabilities

A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1 affecting the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java in the Authentication Flow component. Manipulation of the arguments cod/jwt leads to missing authorization. The attack may be launched remotely and the exploit is public. The project was informed but has not responded.

A weakness has been identified in projeto-siga siga up to 11.1.1. The function DownloadExterno.getUrl in the HTML-to-PDF Endpoint component is affected. Manipulation of the html argument causes server-side request forgery, which can be initiated remotely. The exploit has been made public.

A cross-site scripting vulnerability was found in projeto-siga siga version 11.0.3.18 in an unknown function of /sigawf/app/responsavel/novo. Manipulating the Nome/Descrição argument results in script injection. The attack can be initiated remotely and a public exploit is available.