PT-2022-9780 · Unknown · Mangboard Commerce Package

Published 2022-05-19 · Updated 2022-06-01 · CVE-2021-26631

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mangboard commerce package (affected versions not specified)

Description The issue is related to improper input validation, allowing a remote attacker to manipulate the total order amount into a negative number and then pay for the order. This can occur due to abnormal requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-26631

Affected Products

Mangboard Commerce Package

References · 5

• https://osv.dev/vulnerability/CVE-2021-26631 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26631 · Security Note
• https://t.me/cibsecurity/42983 · Telegram Post
• https://t.me/cvenotify/30987 · Telegram Post
• https://krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66724 · Note