GitHub Advisoryadvisory · Packagist

GHSA-jfph-3hpg-2f65 Incorrect Permission Assignment for Critical Resource in ShopXO

CRITICAL Published 2022-05-03 Modified 2022-05-24 Official page ↗

Aliases: CVE-2022-28056
Ecosystem: Packagist
Packages: shopxo/shopxo
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-732
Reviewed: 2022-05-24

Affected packages

• Packagist shopxo/shopxo: < 2.2.6 → fixed in 2.2.6

Description

ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in app/install/controller/Index.php.

Related

Alias · CVE (1)

CVE-2022-28056 ShopXO v2.2.5 and below was discovered to contain a system re-install vulnerability via the Add function in… vulnerability

Weakness · CWE (1)

CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References