GitHub Advisoryadvisory · npm
GHSA-hr89-w7p6-pjmq express-cart allows any user to create an admin user
HIGH
Official page ↗
- Aliases
- CVE-2018-12457
- Ecosystem
- npm
- Packages
- express-cart
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-732
- Reviewed
- 2024-04-01
Affected packages
• npm express-cart: < 1.1.6 → fixed in 1.1.6
Description
Express-Cart before 1.1.6 allows remote attackers to create an admin user via an `/admin/setup` Referer header.
Related
Alias · CVE (1)
- CVE-2018-12457 expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header. vulnerability
Weakness · CWE (1)
- CWE-732 Incorrect Permission Assignment for Critical Resource weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-12457 advisory
- https://github.com/mrvautin/expressCart/commit/baccaae9b0b72f00b10c5453ca00231340ad3e3b web
- https://hackerone.com/reports/343626 web
- https://github.com/mrvautin/expressCart package
- https://github.com/nodejs/security-wg/blob/main/vuln/npm/469.json web
- https://snyk.io/vuln/npm:express-cart:20180712 web
- https://www.npmjs.com/advisories/730 web
- https://www.npmjs.com/package/express-cart?activeTab=versions web