A vulnerability has been reported in CDS Invenio, which can be exploited by malicious users to manipulate certain data.

The vulnerability is caused due to an error in the email notification alert facility. This can be exploited to delete the personal email notification alerts of another user by accessing a specially crafted URL.

Successful exploitation requires valid user credentials and the knowledge of the victim's internal UID.

The vulnerability is reported in version 0.92.1. Other versions may also be affected.

Solution
Update to version 0.99.0.
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://cdsware.cern.ch/lists/project-cdsware-announce/archive/msg00021.shtml

Deep Links
Links available in Customer Area