PT-2019-15910 · Nopcommerce · Nopcommerce

Klezvirus · Published 2019-12-09 · Updated 2019-12-17 · CVE-2019-19685

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nopCommerce version 4.2.0

Description The issue allows for Cross-Site Request Forgery (CSRF) attacks because GET requests can be used to perform actions such as renames and deletions.

Recommendations For nopCommerce version 4.2.0, consider implementing proper CSRF protection mechanisms to prevent unauthorized actions. As a temporary workaround, restrict access to sensitive operations that can be performed via GET requests until a proper fix is applied.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-19685

Affected Products

Nopcommerce

References · 4

• 🔥 https://github.com/klezVirus/cves/tree/master/NopCommerce/Cross-Site-Request-Forgery · Exploit
• https://osv.dev/vulnerability/CVE-2019-19685 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19685 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19685 · Note