Authentication Bypass by Spoofing in express-cart

高危 8.8CVE-2018-16483 · GHSA-wj36-v8j4-pc7c · Published 01/02/2019 · updated 17/06/2026

要点

CVE-2018-16483 是影响 express-cart (express-cart project), express-cart 的高危 (CVSS 8.8)漏洞。
未来 30 天内被利用的概率（EPSS）：1.2%，高于 67.1% 的漏洞。
修复：升级到 1.1.6 或更高版本。

Package	Affected versions	Patched versions
express-cart express-cart_project	`≤ 1.1.5`	No fix yet
express-cart npm	`< 1.1.6`	`1.1.6`

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

NVD description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

≤ 1.1.5

No fix yet

npm

< 1.1.6

1.1.6

Description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

NVD description

A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administrators.

express-cart 的其他漏洞

查看全部 →