CVE-2018-16483 - A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators

HIGH

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators

Published Feb 1, 2019

8.8

HIGH

CVSS 3.0

EPSS 1.16%

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Version	Status	Constraints
>=1.1.6	affected	-

Ecosystem	Package	Introduced	Fixed
npm	express-cart	0	1.1.6

No remediation recorded yet.

Weaknesses (1)

CWE-290

Authentication Bypass by Spoofing

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-0354		Advisory
https://github.com/advisories/GHSA-wj36-v8j4-pc7c		Advisory
https://hackerone.com/reports/343626		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-16483