Authentication Bypass by Spoofing in express-cart

ALTO 8.8CVE-2018-16483 · GHSA-wj36-v8j4-pc7c · Published 01/02/2019 · updated 17/06/2026

En resumen

CVE-2018-16483 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a express-cart (express-cart project), express-cart.
Probabilidad de explotación en los próximos 30 días (EPSS): 1.2%, mayor que el 67.1% de las vulnerabilidades.
Solución: actualizar a 1.1.6 o posterior.

Package	Affected versions	Patched versions
express-cart express-cart_project	`≤ 1.1.5`	No fix yet
express-cart npm	`< 1.1.6`	`1.1.6`

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

NVD description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≤ 1.1.5

No fix yet

npm

< 1.1.6

1.1.6

Description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

NVD description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

Más vulnerabilidades de express-cart

Ver todo →