Threats tagged 'ghsa-5ww9-qwj2-mr7g'

Open WES versions up to 1.0.0 have an authorization bypass vulnerability that allows authenticated users with menu permission to modify stock records of other warehouses. This occurs because the GlobalGatewayFilter does not enforce warehouse-specific authorization scoping. Attackers can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in warehouses they should not control.