PT-2000-1911 · Element · Element Instantshop

Publicado 2000-12-11 · Atualizado 2017-10-10 · CVE-2000-1001

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Element InstantShop (affected versions not specified)

Description The issue allows remote attackers to modify price information. This is achieved by exploiting the add 2 basket.asp file in Element InstantShop via the price hidden form variable.

Recommendations For Element InstantShop, restrict access to the add 2 basket.asp file to minimize the risk of exploitation. Avoid using the price variable in the affected file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2000-1001

Produtos afetados

Element Instantshop

Referências · 4

• http://marc.info/?l=bugtraq&m=97240616129614&w=2 · Nota
• http://osvdb.org/6487 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2000-1001 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/5402 · Nota