CVE-2024-49373

Centurion ERP user can view projects from organizations they're not apart of

State: Published
Severity: 4.1 Medium
Published: Oct 22, 2024
Updated: Oct 22, 2024
Reserved: Oct 14, 2024

Description

No Fuss Computing Centurion ERP is open source enterprise resource planning (ERP) software. Prior to version 1.2.1, an authenticated user can view projects within organizations they are not apart of. Version 1.2.1 fixes the problem.

Scores

CVSS	Score	Vector	Source
3.1	4.1 Medium	CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N	GitHub_M

Weaknesses

CWE-653 Improper Isolation or Compartmentalization

Affected Products

Product	Versions
centurion_erpnofusscomputing	< 1.2.1Affected

References

https://github.com/nofusscomputing/centurion_erp/security/advisories/GHSA-5qmx-pr2f-qhj5
https://github.com/nofusscomputing/centurion_erp/pull/358
https://github.com/nofusscomputing/centurion_erp/commit/c3a4685200faa060167d4fde86e806dc91eddcae

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.