CVE-2019-18608 - Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests

Back Back to CVE browser

HIGH

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests

Published Oct 29, 2019

7.5

HIGH

CVSS 3.1

EPSS 0.97%

Description

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order (e.g., its payment status or shipping fee) by adding additional attributes to user-input during the PUT /ajax/cart operation for a checkout, because of getValidDocumentForUpdate in api/server/services/orders/orders.js.

Affected products

Ecosystem	Package	Introduced	Fixed
npm	cezerin	0	not fixed

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (3)

https://github.com/advisories/GHSA-6pq6-crw9-522h
Advisory
https://github.com/cl0udz/vulnerabilities/blob/master/cezerin-manipulate_order_information/README.md
x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-18608

Link	Providers	Tags
https://github.com/advisories/GHSA-6pq6-crw9-522h		Advisory
https://github.com/cl0udz/vulnerabilities/blob/master/cezerin-manipulate_order_information/README.md		x_refsource_MISCExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-18608