CyberRota Analysis
AI-GeneratedAureus ERP versions prior to 1.5.0 are vulnerable due to inadequate scoping of message lookups in ChatterPanel, enabling authenticated users to access and manipulate messages across different departments or companies. This flaw allows attackers to read, edit, delete, or pin arbitrary messages and enumerate all notes within the system, posing a significant risk to data confidentiality and integrity. Organizations using affected versions should prioritize immediate updates to mitigate potential data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.