express-cart allows any user to create an admin user

높음 8.8CVE-2018-12457 · GHSA-hr89-w7p6-pjmq · Published 15/06/2018 · updated 17/06/2026

요약

CVE-2018-12457은(는) expresscart (expresscart project), express-cart에 영향을 주는 높음 (CVSS 8.8) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.9%, 전체 취약점의 79.6%보다 높음.
조치: 1.1.6 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
expresscart expresscart_project	`< 1.1.6`	`1.1.6`
express-cart npm	`< 1.1.6`	`1.1.6`

Express-Cart before 1.1.6 allows remote attackers to create an admin user via an /admin/setup Referer header.

NVD description

expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.