| Package | Affected versions | Patched versions |
|---|---|---|
| business workflow | < 1.18.1 | 1.18.1 |
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free