GHSA-896v-ph5w-379h

Economizzer Insecure Direct Object Reference vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2023-38872

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	gugoan/economizzer	<= 0.9-beta1	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-38872 advisory
https://github.com/gugoan/economizzer/commit/37308802dfe00d43df396a8afaa2096ece8b7b57 web
https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38872 web
https://github.com/gugoan/economizzer package
https://www.economizzer.org web