PT-2019-19995 · Express · Express-Cart

Published 2019-06-03 · Updated 2019-06-03

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions express-cart versions prior to 1.1.6

Description The issue allows normal users to escalate their privileges, enabling them to add new administrator users.

Recommendations Update to version 1.1.6 or later.

Fix

Related Identifiers

GHSA-3FC5-9X9M-VQC4

Affected Products

Express-Cart

References · 6

• https://osv.dev/vulnerability/GHSA-3fc5-9x9m-vqc4 · Vendor Advisory
• https://github.com/mrvautin/expressCart/commit/baccaae9b0b72f00b10c5453ca00231340ad3e3b · Note
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/469.json · Note
• https://npmjs.com/advisories/730 · Note
• https://hackerone.com/reports/343626 · Note
• https://snyk.io/vuln/npm:express-cart:20180712 · Note