PT-2020-12488 · Shopizer · Shopizer

Yannick Gosset · Published 2020-04-16 · Updated 2020-04-29 · CVE-2020-11007

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Shopizer versions prior to 2.11.0

Description The issue arises from inadequate validation of negative quantity when using API or Controller based versions, leading to incorrect shopping cart and order totals. This allows for the creation of a negative total in the shopping cart.

Recommendations For versions prior to 2.11.0, update to version 2.11.0 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2020-11007

GHSA-W8RC-PGXQ-X2CJ

Affected Products

Shopizer

References · 5

• https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11007 · Security Note
• https://osv.dev/vulnerability/GHSA-w8rc-pgxq-x2cj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-11007 · Vendor Advisory
• https://github.com/shopizer-ecommerce/shopizer/security/advisories/GHSA-w8rc-pgxq-x2cj · Note