Cross-Site Request Forgery in Bagisto E-Commerce Platform
CVE-2019-14933

8.8HIGH

Key Information:

Vendor
Webkul
Status
Bagisto
Vendor
CVE Published:
11 August 2019

Summary

Bagisto version 0.1.5 is susceptible to Cross-Site Request Forgery (CSRF) attacks, specifically affecting the /admin URIs. This vulnerability allows an attacker to trick an authenticated user into executing unwanted actions on the application without their consent. Organizations using this version need to implement proper safeguards to mitigate potential exploitation of this security risk.

References

https://github.com/bagisto/bagisto/issues/750
x_refsource_MISC
https://forums.bagisto.com/category/1/announcements
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.