CVE-2020-11007: Negative charge in shopping cart possible in Shopizer

Q: What is the severity of CVE-2020-11007?

CVE-2020-11007 has a medium severity rating due to inadequate validation of negative quantities, potentially affecting financial calculations.

Q: How do I fix CVE-2020-11007?

To fix CVE-2020-11007, update to Shopizer version 2.11.0 or later.

Q: What is the impact of CVE-2020-11007 on affected versions?

CVE-2020-11007 can lead to incorrect shopping cart totals and order processing issues.

Q: Which versions of Shopizer are affected by CVE-2020-11007?

Shopizer versions prior to 2.11.0 are affected by CVE-2020-11007.

Q: Is CVE-2020-11007 a common vulnerability?

CVE-2020-11007 is specific to Shopizer and may not be widespread but poses a significant risk to those using the affected version.

Published Apr 16, 2020

Updated

In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes it possible to create a negative total in the shopping cart. This has been patched in version 2.11.0.

Affected Software

1 affected component

Shopizer Shopizer<2.11.0

Remediation

Patch Available

https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a

Event History

Apr 16, 2020

CVE Published

via MITRE·06:20 PM

Data Sourced

via MITRE·06:20 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2020-11007?

CVE-2020-11007 has a medium severity rating due to inadequate validation of negative quantities, potentially affecting financial calculations.

How do I fix CVE-2020-11007?