CVE-2019-16403: Authorization Bypass Through User-Controlled Key in Bagisto
Published Sep 18, 2019
·Updated
Authorization Bypass Through User-Controlled Key in Bagisto
Other sources
In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.
Affected Software
3 affected componentsFixes available
Webkul Bagisto<0.1.5
composer/bagisto/bagisto<0.1.5
0.1.5
composer/bagisto/bagisto<0.1.5
0.1.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/bagisto/bagistoto a version that resolves this vulnerability.Fixed in 0.1.5
Event History
Sep 18, 2019
CVE Published
via MITRE·11:49 AM
Data Sourced
via MITRE·11:49 AM
Description
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Nov 8, 2019
Advisory Published
via GitHub·08:06 PM
Data Sourced
via GitHub·08:06 PM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via Packagist·08:06 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2019-16403.
2
What is the severity of CVE-2019-16403?
The severity of CVE-2019-16403 is high (8.8).
3
What is the affected software?
The affected software is Webkul Bagisto before version 0.1.5.
4
What is the CWE ID?
The CWE ID is 639.
5
How can I fix CVE-2019-16403?
To fix CVE-2019-16403, update Webkul Bagisto to version 0.1.5 or above.