Authentication Bypass by Spoofing in express-cart

HOCH 8.8CVE-2018-16483 · GHSA-wj36-v8j4-pc7c · Published 01/02/2019 · updated 17/06/2026

Kurz gesagt

CVE-2018-16483 ist eine Schwachstelle (HOCH (CVSS 8.8)) in express-cart (express-cart project), express-cart.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 1.2%, höher als bei 67.1% aller Schwachstellen.
Abhilfe: auf 1.1.6 oder neuer aktualisieren.

Package	Affected versions	Patched versions
express-cart express-cart_project	`≤ 1.1.5`	No fix yet
express-cart npm	`< 1.1.6`	`1.1.6`

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

NVD description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≤ 1.1.5

No fix yet

npm

< 1.1.6

1.1.6

Description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

NVD description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

Weitere Schwachstellen in express-cart

Alle anzeigen →