CVE-2024-37889 (published 2024-06-14T20:15Z)

MyFinances is a web application for managing finances. MyFinances has a way to access other customer invoices while signed in as a user. This method allows an actor to access PII and financial information from another account. The vulnerability is fixed in 0.4.6.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/TreyWW/MyFinances
commit_details: repo_url: https://github.com/TreyWW/MyFinances
author: Trey
author_date: 2024-06-14 17:59:57+01:00
msg: Merge pull request from GHSA-4884-3gvp-3wj2

* security fix: added permission check for the view page of editing an invoice

* Version updated from 0.4.5 to 0.4.6

Signed-off-by: Trey <73353716+TreyWW@users.noreply.github.com>

---------

Signed-off-by: Trey <73353716+TreyWW@users.noreply.github.com>
repository: repo_url: https://github.com/TreyWW/MyFinances
repo_name: TreyWW/MyFinances
description: MyFinances is a web application that can help you as an individual, or team, manage your finances!
repo_language: Python
owner: TreyWW
file_changes: filename: __init__.py
change_type: ModificationType.MODIFY
diff: @@ -1 +1 @@
-__version__ = "0.4.5"
+__version__ = "0.4.6"

programming_language: SQL
filename: edit.py
change_type: ModificationType.MODIFY
diff: @@ -2,7 +2,8 @@ from datetime import datetime
 
 from django.contrib import messages
 from django.http import JsonResponse
-from django.shortcuts import render
+from django.http.response import HttpResponse
+from django.shortcuts import render, redirect
 from django.views.decorators.http import require_http_methods
 
 from backend.models import Invoice, Client, InvoiceItem
@@ -56,8 +57,13 @@ def invoice_get_existing_data(invoice_obj):
 def invoice_edit_page_get(request, invoice_id):
     try:
         invoice = Invoice.objects.get(id=invoice_id)
+
+        if not invoice.has_access(request.user):
+            messages.error(request, "You are not permitted to edit this invoice")
+            return redirect("invoices:dashboard")
     except Invoice.DoesNotExist:
-        return JsonResponse({"message": "Invoice not found"}, status=404)
+        messages.error(request, "Invoice not found")
+        return redirect("invoices:dashboard")
 
     # use to populate fields with existing data in edit_from_destination.html AND edit_to_destination.html
     data_to_populate = invoice_get_existing_data(invoice)
@@ -72,12 +78,7 @@ def edit_invoice(request: HtmxHttpRequest, invoice_id):
     except Invoice.DoesNotExist:
         return JsonResponse({"message": "Invoice not found"}, status=404)
 
-    if request.user.logged_in_as_team and request.user.logged_in_as_team != invoice.organization:
-        return JsonResponse(
-            {"message": "You do not have permission to edit this invoice"},
-            status=403,
-        )
-    elif request.user != invoice.user:
+    if not invoice.has_access(request.user):
         return JsonResponse(
             {"message": "You do not have permission to edit this invoice"},
             status=403,

programming_language: Python
filename: pyproject.toml
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 [tool.poetry]
 name = "MyFinances"
-version = "0.4.5"
+version = "0.4.6"
 description = "github.com/TreyWW/MyFinances"
 authors = ["TreyWW"]
 readme = "README.md"
@@ -94,7 +94,7 @@ requires = ["poetry-core"]
 build-backend = "poetry.core.masonry.api"
 
 [tool.bumpversion]
-current_version = "0.4.5"
+current_version = "0.4.6"
 commit = true
 commit_args = "-s"
 tag = true

programming_language: Python