Access Control Flaw in Express Cart Affects Unprivileged User Privileges
CVE-2018-16483

8.8HIGH

Key Information:

Vendor

Hackerone

Status
Express-cart
Vendor
CVE Published:
1 February 2019

What is CVE-2018-16483?

A persistent flaw in the access control mechanism of the Express Cart plugin up to version 1.1.5 allows unauthorized users to elevate their privileges and gain administrative access. This security oversight poses a significant risk, enabling malicious actors to manipulate settings and user accounts within the application, potentially leading to broader system compromises.

Affected Version(s)

express-cart >=1.1.6

References

https://hackerone.com/reports/343626
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.