GitHub Advisoryadvisory · Packagist

GHSA-pwrf-q7h8-jjr7 Authorization Bypass Through User-Controlled Key in Bagisto

MEDIUM Published 2019-11-08 Modified 2021-05-10 Official page ↗
Aliases
CVE-2019-16403
Ecosystem
Packagist
Packages
bagisto/bagisto
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-639
Reviewed
2019-09-25

Affected packages

• Packagist bagisto/bagisto: < 0.1.5 → fixed in 0.1.5

Description

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.

Related

Alias · CVE (1)

  • CVE-2019-16403 In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References