CVE-2024-14046: OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload
A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.2 is capable of addressing this issue. The identifier of the patch is e945d6bfcec29642f514e7d298dfba2cc6cd7cd4. Upgrading the affected component is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenBoxesto a version that resolves this vulnerability.Fixed in 0.9.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch e945d6bfcec29642f514e7d298dfba2cc6cd7cd4
Event History
Frequently Asked Questions
Which versions require remediation, and what update fixes the issue?
OpenBoxes versions up to 0.9.1 are affected. Upgrading to version 0.9.2 addresses the issue; the referenced patch identifier is e945d6bfcec29642f514e7d298dfba2cc6cd7cd4.
What level of access does an attacker need to exploit this?
An attacker can initiate exploitation remotely, but the severity vector indicates that low privileges are required. No user interaction is required.
Are default OpenBoxes deployments affected?
The available data does not state whether document upload is enabled or exposed in a default deployment. Systems running an affected version should be treated as potentially exposed where the Document Upload Controller is reachable by a low-privileged account.
How urgent is remediation?
Public exploit disclosure is reported, so exploitation may be practical. The stated impacts include low-level effects on confidentiality, integrity, and availability.