LiveActive security incident?Get immediate response
CVE Record

CVE-2024-14046: OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload

A security vulnerability has been detected in OpenBoxes up to 0.9.1. This issue affects the function DocumentController of the file grails-app/controllers/org/pih/warehouse/core/DocumentController.groovy of the component Document Upload Controller. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 0.9.2 is capable of addressing this issue. The identifier of the patch is e945d6bfcec29642f514e7d298dfba2cc6cd7cd4. Upgrading the affected component is recommended.

MediumCVSS 6.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

OpenBoxes versions through 0.9.1 contain a document-upload weakness that may let an authenticated remote user upload files without adequate restrictions. This could affect confidentiality, data integrity, and service availability. A public proof of concept increases practical risk, but the supplied sources do not establish active exploitation.

Executive priority

Prioritize remediation in the normal urgent patch cycle, accelerating internet-facing or broadly accessible deployments. The public proof of concept raises risk, while required authentication and the absence of confirmed active exploitation temper urgency. Investigate immediately if suspicious uploads or unexpected files are found.

Technical view

CVE-2024-14046 affects DocumentController.groovy in the OpenBoxes Document Upload Controller. Insufficient authorization or file-upload restrictions are classified as CWE-284 and CWE-434. The supplied CVSS v2 vector scores 6.5 and indicates network access, low complexity, and required authentication. Commit e945d6b and release 0.9.2 are identified as remediation.

Likely exposure

Highest exposure is on OpenBoxes 0.9.0 or 0.9.1 where document uploading is reachable by untrusted authenticated users, especially internet-accessible deployments. The supplied affected-version list includes 0.9.2 despite separately identifying it as fixed; organizations should verify the installed build and patch contents rather than relying solely on version metadata.

Exploitation context

A public proof of concept is referenced, so defenders should assume technical details are available. However, CVE-2024-14046 is not identified as a CISA KEV entry, and the supplied sources provide no evidence of active exploitation. The CVSS vector indicates that some authenticated access is required.

Researcher notes

The source bundle conflicts on version 0.9.2: narrative, patch, and release references describe it as fixed, while structured affected data includes it. The CVSS v2 vector specifies Au:S, supporting authenticated exploitation. Validate authorization, filename handling, content restrictions, storage location, and execution controls without assuming the upload alone guarantees code execution.

Mitigation direction

  • Upgrade OpenBoxes to version 0.9.2 or a later vendor-supported release.
  • Confirm the deployed build contains commit e945d6bfcec29642f514e7d298dfba2cc6cd7cd4.
  • Restrict document-upload access to trusted users until remediation is verified.
  • Review vendor guidance for any additional configuration or cleanup requirements.

Validation and detection

  • Inventory every OpenBoxes deployment and record its exact version and build provenance.
  • Verify upload-controller code includes the referenced patch changes.
  • Test that unauthorized file types and unsafe upload behavior are rejected.
  • Review upload records and stored files for unexpected content or suspicious user activity.
  • Confirm document-upload access is unavailable to unauthenticated users.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-284: Authorization and privilege behavior lookup

Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cwe · medium confidence lookup

CWE-434: File access and web shell behavior lookup

File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-14046 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
6.5 (2.0)
Known Exploited
No
Published

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

4CVSS vectors
6Timeline events
1ADP providers
10Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: partial

CVSS vector scores

4 official scores

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
6.5CVSS 2.0MediumAV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C86.4VulDB
6.3CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C2.83.4VulDB
6.3CVSS 3.0MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C2.83.4VulDB
5.3CVSS 4.0MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P——VulDB

Vulnerability scoring details

Base CVSS 4.0 score

5.3Medium
CVSS 4.0 vector shape for CVE-2024-14046Attack VectorAttack ComplexityAttack RequirementsPrivileges RequiredUser InteractionVS ConfidentialityVS IntegrityVS AvailabilitySS ConfidentialitySS IntegritySS Availability

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Attack Requirements
NonePresent
Privileges Required
NoneLowHigh
User Interaction
NonePassiveActive
VS Confidentiality
HighLowNone
VS Integrity
HighLowNone
VS Availability
HighLowNone
SS Confidentiality
HighLowNone
SS Integrity
HighLowNone
SS Availability
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineVulDB

    Advisory disclosed

  2. Source timelineVulDB

    VulDB entry created

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. Source timelineVulDB

    VulDB entry last update

  5. CVE publishedCVE Program

    The CVE record was published.

  6. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/aOpenBoxes0.9.0, 0.9.1, 0.9.2Listed
Weakness

CWE details

CWE-284CWE-434

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.