M2Soft CROWNIX Report & ERS Incorrect Access Control Vulnerability Granting Administrator Privileges

A vulnerability exists in M2Soft CROWNIX Report & ERS versions 7.x prior to 7.4.3.599 and 8.x prior to 8.0.3.79, allowing unauthorized attackers to gain access to Administrator accounts. This issue stems from incorrect access control, particularly in the ManagerService component, which failed to properly validate user permissions before allowing access to sensitive administrative functions.

Impact

Exploitation of this vulnerability allows unauthorized users to obtain Administrator privileges, potentially leading to further exploitation or misuse of administrative capabilities within the application.

Remediation

Users are advised to update to CROWNIX Report & ERS version 7.4.3.561 or 8.0.3.82. For assistance, contact the M2Soft technical support center by phone or email.