CVE-2021-44838

The CVE-2021-44838 issue affects Delta RM 1.2. The vulnerability arises in the /risque/risque/ajax-details endpoint, where a POST request that includes an id parameter can allow a user to access risks from other companies. This represents a cross-entity exposure within the risk-management web int...

CVE-2021-44836

Delta RM 1.2 contains an access-control flaw in the /risque/risque/workflow/reset endpoint, allowing an unprivileged user to reopen a risk via POST with risqueID. Root cause: missing access controls on the reset workflow. Impact: potential unauthorized modification of risk states; no explicit exp...

CVE-2021-44840

Delta RM 1.2 contains a vulnerability where a privileged user can edit, create, and delete the following risk labels (Priority Indication, Quality Evaluation, Progress Margin, Priority) via the /core/table/query endpoint using a POST request with the affected label identified by tableUid and the ...

CVE-2021-44839

Delta RM 1.2 contains a vulnerability where an attacker can request password resets for other accounts via the endpoint /listes/DTsendmaildata/adm_utilisateur/send-mail.json by submitting a JSON array of target user IDs. This could result in new passwords being sent to the corresponding email add...

CVE-2021-44837

Delta RM 1.2 is affected by an authorization issue where an unprivileged user can access the same information as an administrator regarding risk creation via the endpoint /risque/administration/referentiel/json/create/categorie using the id_cat1 parameter. The root cause is insufficient access co...