CVE-2019-18608: Cezerin Unauthorized Acces

May 24, 2022 (updated July 18, 2023)

Cezerin v0.33.0 allows unauthorized order-information modification because certain internal attributes can be overwritten via a conflicting name when processing order requests. Hence, a malicious customer can manipulate an order (e.g., its payment status or shipping fee) by adding additional attributes to user-input during the PUT /ajax/cart operation for a checkout, because of getValidDocumentForUpdate in api/server/services/orders/orders.js.

References

github.com/advisories/GHSA-6pq6-crw9-522h
github.com/cl0udz/vulnerabilities/blob/master/cezerin-manipulate_order_information/README.md
nvd.nist.gov/vuln/detail/CVE-2019-18608

Code Behaviors & Features

Detect and mitigate CVE-2019-18608 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →