CVE-2020-12101

Related Files

xt:Commerce 5.4.1 / 6.2.1 / 6.2.2 Improper Access Control

Posted May 1, 2020

Authored by Fabian Krone, Markus Weiler | Site syss.de

xt:Commerce version 5.4.1, 6.2.1, and 6.2.2 suffer from an improper access control vulnerability. A logged-in customer can create and alter addresses. These addresses are referenced by incrementing IDs. On saving an address, an attacker could change the ID of the address to write the data to. If the ID belongs to an address which does not belong to the current logged-in user, every field in the address is set to null. An attacker could use this to null all addresses in a shop.

tags | exploit

advisories | CVE-2020-12101

SHA-256 | f54fc2ef6644a4e641224c9d4bbfedbcbc95e27c9202e6200a1ccd2764b4b697

Download | Favorite | View