Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNmYzUtOXg5bS12cWM0

Privilege Escalation in express-cart

Versions of express-cart before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so that normal users can escalate their privilege and add new administrator users.

Recommendation

Update to version 1.1.6 or later.

Permalink: https://github.com/advisories/GHSA-3fc5-9x9m-vqc4
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLTNmYzUtOXg5bS12cWM0
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: over 5 years ago
Updated: almost 2 years ago

CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-3fc5-9x9m-vqc4
References:

• https://github.com/mrvautin/expressCart/commit/baccaae9b0b72f00b10c5453ca00231340ad3e3b
• https://www.npmjs.com/advisories/730
• https://hackerone.com/reports/343626
• https://github.com/nodejs/security-wg/blob/master/vuln/npm/469.json
• https://snyk.io/vuln/npm:express-cart:20180712
• https://github.com/advisories/GHSA-3fc5-9x9m-vqc4

Repository: https://github.com/mrvautin/expressCart
Blast Radius: 3.0

Affected Packages