Hallo Welt! GmbH BlueSpice Extension:NSFileRepo Incorrect Permission Assignment Vulnerability Allowing Access Control Bypass

A vulnerability in Hallo Welt! GmbH BlueSpice, specifically in the Extension:NSFileRepo modules, has been identified. This issue allows access to functionalities that are not properly restricted by Access Control Lists (ACLs), effectively bypassing electronic locks and access controls. The vulnerability is present in BlueSpice versions 5.1 through 5.1.3 and 5.2 through 5.2.0, as well as in Extension:NSFileRepo versions 3.0 prior to 3.0.5.

Impact

Exploitation of this vulnerability could lead to unauthorized access to files or directories, allowing external parties to bypass established access controls and electronic locks.

Remediation

Users can update to BlueSpice PRO/FARM versions 5.1.4 or 5.2.1 to address this vulnerability.