GitHub Advisoryadvisory · npm

GHSA-6pq6-crw9-522h Cezerin Unauthorized Acces

HIGH Published 2022-05-24 Modified 2023-09-26 Official page ↗
Aliases
CVE-2019-18608
Ecosystem
npm
Packages
cezerin
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2023-07-18

Affected packages

• npm cezerin: <= 0.33.0 (no fix yet)

Description

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order (e.g., its payment status or shipping fee) by adding additional attributes to user-input during the PUT `/ajax/cart` operation for a checkout, because of `getValidDocumentForUpdate` in `api/server/services/orders/orders.js`.

Related

Alias · CVE (1)

  • CVE-2019-18608 Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References