GitHub Advisoryadvisory · npm
GHSA-h5q8-5697-9p9h Cross-Site Request Forgery in express-cart
HIGH
Official page ↗
- Aliases
- CVE-2020-22403
- Ecosystem
- npm
- Packages
- express-cart
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-352
- Reviewed
- 2021-08-30
Affected packages
• npm express-cart: < 1.1.17 → fixed in 1.1.17
Description
The express-cart package through 1.1.10 for Node.js allows CSRF.
Related
Alias · CVE (1)
- CVE-2020-22403 Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code… vulnerability
Weakness · CWE (1)
- CWE-352 Cross-Site Request Forgery weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-22403 advisory
- https://github.com/mrvautin/expressCart/issues/120 web
- https://github.com/mrvautin/expressCart/commit/cd3ba1bc609c2f2946bfbc7ee2fccf3483eb71fb web
- https://hackerone.com/reports/395944 web
- https://github.com/mrvautin/expressCart package
- https://security.netapp.com/advisory/ntap-20210909-0004 web
- https://www.npmjs.com/package/express-cart web