CVE-2014-4963: Medium severity shopizer vulnerability
Published Jul 15, 2014
·Updated
Shopizer 1.1.5 and earlier allows remote attackers to modify the account settings of arbitrary users via the customer.customerId parameter to shop/profile/register.action.
Affected Software
1 affected component
Shopizer Shopizer<=1.1.5
Event History
Jul 15, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-4963?
CVE-2014-4963 is classified as a moderate severity vulnerability that allows unauthorized modification of user accounts.
2
How do I fix CVE-2014-4963?
To fix CVE-2014-4963, upgrade to Shopizer version 1.1.6 or later, which resolves the vulnerability.
3
What types of attacks are possible with CVE-2014-4963?
CVE-2014-4963 allows remote attackers to change account settings of arbitrary users by manipulating the customer.customerId parameter.
4
Which versions of Shopizer are affected by CVE-2014-4963?
Shopizer versions 1.1.5 and earlier are affected by CVE-2014-4963.
5
Is user data at risk due to CVE-2014-4963?
Yes, CVE-2014-4963 can lead to unauthorized access and modification of user account data.