LatePoint

The booking step loader fetched an existing booking by id without checking it belongs to the requesting customer, letting a visitor read or alter someone else’s booking. The fix verifies ownership and refuses otherwise. Fixed in 5.2.7.

This vulnerability affects the following application versions:

• LatePoint 5.1.0
• LatePoint 5.1.1
• LatePoint 5.1.2
• LatePoint 5.1.3
• LatePoint 5.1.4
• LatePoint 5.1.5
• LatePoint 5.1.6
• LatePoint 5.1.7
• LatePoint 5.1.8
• LatePoint 5.1.9
• LatePoint 5.1.91
• LatePoint 5.1.92
• LatePoint 5.1.93
• LatePoint 5.1.94
• LatePoint 5.2.0
• LatePoint 5.2.1
• LatePoint 5.2.2
• LatePoint 5.2.3
• LatePoint 5.2.4
• LatePoint 5.2.5
• LatePoint 5.2.6