Vulnerability · Published Apr 16, 2020 · Assigned by GitHub_M
CVE-2020-11007Negative charge in shopping cart possible in Shopizer
Medium 6.5
In plain English
A medium-severity improper input validation in shopizer from shopizer-ecommerce. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes it possible to create a negative total in the shopping cart. This has been patched in version 2.11.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Maven | com.shopizer:sm-core-model | 2.11.0 | GHSA-w8rc-pgxq-x2cj |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| shopizer-ecommerce | shopizer | < 2.11.0 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N