Cross-Site Request Forgery in express-cart

ALTO 8.8CVE-2020-22403 · GHSA-h5q8-5697-9p9h · Published 12/08/2021 · updated 17/06/2026

In breve

CVE-2020-22403 è una vulnerabilità ALTO (CVSS 8.8) che riguarda express-cart (express-cart project), express-cart.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.57%, superiore al 47.0% delle vulnerabilità.
Correzione: aggiornare a 1.1.17 o successiva.

Package	Affected versions	Patched versions
express-cart express-cart_project	`≤ 1.1.10`	No fix yet
express-cart npm	`< 1.1.17`	`1.1.17`

Description

The express-cart package through 1.1.10 for Node.js allows CSRF.

NVD description

Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code or other unspecified impacts.

References

nvd.nist.gov/vuln/detail/CVE-2020-22403 · ADVISORY
mrvautin/expressCart · WEB
mrvautin/expressCart commit cd3ba1b · WEB
hackerone.com/reports/395944 · WEB
mrvautin/expressCart · PACKAGE
security.netapp.com/advisory/ntap-20210909-0004 · WEB
npmjs.com/package/express-cart · WEB

Altre vulnerabilità di express-cart

Vedi tutto →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

express-cart

express-cart_project

≤ 1.1.10

No fix yet

express-cart

npm

< 1.1.17

1.1.17

Altre vulnerabilità di express-cart

Vedi tutto →