Andrew Grasso

The issue is related to incorrect access control in the portal messaging system, allowing remote attackers to post messages on behalf of customers and guess document attribute values via crafted parameters.