Authentication Bypass by Spoofing in express-cart

ÉLEVÉE 8.8CVE-2018-16483 · GHSA-wj36-v8j4-pc7c · Published 01/02/2019 · updated 17/06/2026

En bref

CVE-2018-16483 est une vulnérabilité ÉLEVÉE (CVSS 8.8) touchant express-cart (express-cart project), express-cart.
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.2%, plus élevée que 67.1% des vulnérabilités.
Correctif : mettre à jour vers 1.1.6 ou plus récent.

Package	Affected versions	Patched versions
express-cart express-cart_project	`≤ 1.1.5`	No fix yet
express-cart npm	`< 1.1.6`	`1.1.6`

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

NVD description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≤ 1.1.5

No fix yet

npm

< 1.1.6

1.1.6

Description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

NVD description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

Autres vulnérabilités de express-cart

Tout voir →