mrvautin/expresscart · Security
express-cart allows any user to create an admin user
- GHSA ID
- GHSA-hr89-w7p6-pjmq
- CVE ID
- CVE-2018-12457
- Severity
- high
- Published
- Updated
- CVSS
- 8.8 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 8.8 · CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header.
CWEs
- CWE-732 · Incorrect Permission Assignment for Critical Resource
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-12457 ↗
- https://github.com/mrvautin/expressCart/commit/baccaae9b0b72f00b10c5453ca00231340ad3e3b ↗
- https://hackerone.com/reports/343626 ↗
- https://www.npmjs.com/package/express-cart?activeTab=versions ↗
- https://github.com/nodejs/security-wg/blob/main/vuln/npm/469.json ↗
- https://snyk.io/vuln/npm:express-cart:20180712 ↗
- https://www.npmjs.com/advisories/730 ↗
- https://github.com/advisories/GHSA-hr89-w7p6-pjmq ↗