CVE-2024-14045
Received Received - Intake

Improper Authorization in OpenBoxes Product Supplier Edit Controller

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulDB

Description
A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.3 is able to resolve this issue. This patch is called f767ac1a5987d4865d9f158c6a967680f8e45468. It is suggested to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2024-14045
EUVD
EUVD-2024-55724

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
openboxes openboxes to 0.9.2 (inc)
openboxes openboxes 0.9.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper authorization weakness in OpenBoxes up to version 0.9.2. It exists in the RoleInterceptor.groovy file and allows unauthorized remote execution of actions due to insufficient permission checks. The flaw enables attackers to manipulate product supplier edit controller functions without proper authorization.

Detection Guidance

To detect this vulnerability, check if your OpenBoxes instance is running version 0.9.2 or earlier. Verify the presence of the RoleInterceptor.groovy file in the grails-app/controllers/org/pih/warehouse/ directory. Inspect permission rules in runtime.groovy and RoleInterceptor.groovy for improper authorization configurations.

Impact Analysis

An attacker could exploit this to perform unauthorized actions like editing, creating, or deleting product suppliers without proper permissions. This could lead to data tampering, unauthorized access to sensitive information, or disruption of supply chain operations in systems using vulnerable OpenBoxes versions.

Compliance Impact

This improper authorization flaw could violate compliance requirements by allowing unauthorized access to sensitive data, potentially breaching GDPR's data protection principles or HIPAA's access control mandates. Organizations using vulnerable versions may face compliance violations due to insufficient access controls.

Mitigation Strategies

Upgrade OpenBoxes to version 0.9.3 or later to resolve the improper authorization vulnerability. The patch is available in commit f767ac1a5987d4865d9f158c6a967680f8e45468.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-14045. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart