CVE-2024-49373

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-49373
No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user can view projects within organizations they are not apart of. Version 1.2.1 fixes the problem.

4.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-5qmx-pr2f-qhj5 Vendor Advisory
https://github.com/nofusscomputing/centurion_erp/pull/358 Patch
https://github.com/nofusscomputing/centurion_erp/commit/c3a4685200faa060167d4fde86e806dc91eddcae Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:nofusscomputing:centurion_erp:*:*:*:*:*:*:*:*
History

30 Oct 2024, 21:16

Type Values Removed Values Added
References () https://github.com/nofusscomputing/centurion_erp/commit/c3a4685200faa060167d4fde86e806dc91eddcae - () https://github.com/nofusscomputing/centurion_erp/commit/c3a4685200faa060167d4fde86e806dc91eddcae - Patch
References () https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-5qmx-pr2f-qhj5 - () https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-5qmx-pr2f-qhj5 - Vendor Advisory
References () https://github.com/nofusscomputing/centurion_erp/pull/358 - () https://github.com/nofusscomputing/centurion_erp/pull/358 - Patch
CWE CWE-653 NVD-CWE-noinfo
CPE cpe:2.3:a:nofusscomputing:centurion_erp:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
First Time Nofusscomputing centurion Erp
Nofusscomputing

22 Oct 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-22 16:15

Updated : 2024-10-30 21:16

NVD link : CVE-2024-49373

Mitre link : CVE-2024-49373

JSON object : View

Products Affected

nofusscomputing

  • centurion_erp
CWE
NVD-CWE-noinfo