GHSA-896v-ph5w-379hlow3.7
Economizzer Insecure Direct Object Reference vulnerability
The advisory, in context
An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
gugoan/economizzer Packagist
Ecosystem versions
Earlier releases through 0.9-beta1 (inclusive)
No fix recorded for this interval.
3 explicitly affected versions
v0.4-alpha, v0.8-alpha, v0.9-beta1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "0.9-beta1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v0.4-alpha",
"v0.8-alpha",
"v0.9-beta1"
]
}