Threats tagged 'ghsa-39w6-qc54-g7cg'

Open Web Analytics versions before 1.14.1 have an authorization vulnerability that allows authenticated users with view_reports permission on one site to access report data of other sites. This occurs because clickstream and transaction reports are not properly scoped to the authorized siteId, enabling users to supply another site's session_id or order_id to view its visit history, IP addresses, user agents, and order data.