Description
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them.
Medium · 4.3
CVE-2020-26171
EUVD-2020-18796GHSA-xv6f-5jw7-pmw8
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By …
Published Dec 18, 2020 · Updated Aug 4, 2024 · Assigned by mitre