CVE-2024-14045

MEDIUM 6.3

OpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorization

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.3 is able to resolve this issue. This patch is called f767ac1a5987d4865d9f158c6a967680f8e45468. It is suggested to upgrade the affected component.

CWE	CWE-285 CWE-266
Vendor	n/a
Product	openboxes
Published	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for n/a openboxes

Be the first to know when new medium vulnerabilities affecting n/a openboxes are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

n/a / OpenBoxes

0.9.0 0.9.1 0.9.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/391109 vuldb.com: https://vuldb.com/vuln/391109/cti vuldb.com: https://vuldb.com/cve/CVE-2024-14045 vuldb.com: https://vuldb.com/submit/872700 gist.github.com: https://gist.github.com/nedlir/22cf2f1e5dd337ebba12a1be6ee83150 github.com: https://github.com/openboxes/openboxes/pull/4905 github.com: https://github.com/openboxes/openboxes/commit/f767ac1a5987d4865d9f158c6a967680f8e45468 github.com: https://github.com/openboxes/openboxes/releases/tag/v0.9.3 github.com: https://github.com/openboxes/openboxes/

Credits

🔍 nedlir (VulDB User)