high8.1
CVE-2024-44313
TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function
Impact
TastyIgniter 3.7.6 contains an Incorrect Access Control vulnerability in the invoice() function within Orders.php which allows unauthorized users to access and generate invoices due to missing permission checks.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | tastyigniter/tastyigniter | < 4.0.0 | 4.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Tastyigniter | Tastyigniter | Version 3.7.6 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/tastyigniter/TastyIgniter/blob/3.x/app/admin/controllers/Orders.php
- https://medium.com/@cnetsec/cve-2024-44313-incorrect-access-control-in-tastyigniter-3-7-6-01a73c548b74
- https://github.com/advisories/GHSA-gg2f-r4jh-vpmh
- https://nvd.nist.gov/vuln/detail/CVE-2024-44313