Description
yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to delete arbitrary approval workflow steps. Attackers can invoke the DELETE /admin-api/crm/flow/delete-step endpoint without required permissions to remove approval steps that control contract, receivable, and invoice finalization processes.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
guchengwuyue yshop-crm
Default version status: unaffected
0 to ≤ 2.1.3affected
pkg:github/guchengwuyue/yshop-crmReferences
- https://github.com/LinYuanyi1/cve-request-poc/blob/master/yshop-crm/C09_crm_flow_delete_step.py ↗
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/controller/admin/crmflow/CrmFlowController.java#L102 ↗
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/service/crmflow/CrmFlowServiceImpl.java#L230 ↗
- https://github.com/guchengwuyue/yshop-crm/blob/5f5810a0e1e4ab0828523ec299bf973c2f9065d7/yshop-crm/pom.xml#L30 ↗
- https://github.com/guchengwuyue/yshop-crm ↗
- https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-crmflowcontroller-deleteflowstep ↗