GitHub Advisoryadvisory · Packagist

GHSA-vjq3-x3f2-fvxq Account takeover in facturascripts

CRITICAL Published 2022-05-14 Modified 2022-05-25 Official page ↗

Aliases: CVE-2022-1715
Ecosystem: Packagist
Packages: facturascripts/facturascripts
Severity: Critical
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-1125, CWE-522
Reviewed: 2022-05-25

Affected packages

• Packagist facturascripts/facturascripts: < 2022.08 → fixed in 2022.08

Description

Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.08 due to improper type casting.

Related

Alias · CVE (1)

CVE-2022-1715 Account Takeover in GitHub repository neorazorx/facturascripts prior to 2022.07. vulnerability

Weakness · CWE (2)

CWE-1125 Excessive Attack Surface weakness
CWE-522 Insufficiently Protected Credentials weakness

References