Description
CDS Invenio 0.92.1 and earlier allows remote authenticated users to delete email notification alerts of arbitrary users via a modified internal UID.
References
- cdsinvenio-alert-weak-security(41546) vdb-entry
- 28514 vdb-entry
- http://cdsware.cern.ch/lists/project-cdsware-announce/archive/msg00021.shtml
- 29521 third-party-advisory
- http://cdsware.cern.ch/invenio/news.html