GitHub Advisoryadvisory · Maven

GHSA-w8rc-pgxq-x2cj Negative charge in shopping cart in Shopizer

CRITICAL Published 2020-04-22 Modified 2021-01-08 Official page ↗
Aliases
CVE-2020-11007
Ecosystem
Maven
Packages
com.shopizer:sm-core-model
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20
Reviewed
2020-04-16

Affected packages

• Maven com.shopizer:sm-core-model: < 2.11.0 → fixed in 2.11.0

Description

Impact Using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. Patches Adding a back-end verification to check that quantity parameter isn't negative. If so, it is set to 1. Patched in 2.11.0 Workarounds Without uprading, it's possible to just apply the fixes in the same files it's done for the patch. Or you use javax constraint validation on the quantity parameter. References Input Validation Using bean validation constraint Commits with fixes CVE Details below : Mitre NVD Credits Found and solved by Yannick Gosset from Aix-Marseille University cybersecurity master program supervised by Yassine Ilmi

Related

Alias · CVE (1)

  • CVE-2020-11007 In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References