CyberRota Analysis
AI-GeneratedThe metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints are vulnerable due to insufficient record-level permission checks, allowing authenticated users to exploit this weakness. Attackers can enumerate document identifiers to read, modify, or delete attachments and comments that should be restricted based on user roles. Organizations using metasfresh should prioritize addressing this vulnerability to prevent unauthorized access to sensitive information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access.