CVE-2023-6832: Business Logic Errors in microweber/microweber
A vulnerability has been identified in microweber where users can purchase items with a coupon code. If the admin disables the use of the coupon code functionality, but the user sends requests to the API that handles the coupon code, the user can exploit the vulnerability and obtain items at a lower price.
Other sources
Business Logic Errors in GitHub repository microweber/microweber prior to 2.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6832?
CVE-2023-6832 has been classified with a moderate severity level due to potential unauthorized coupon code exploitation.
How do I fix CVE-2023-6832?
To fix CVE-2023-6832, ensure that you upgrade to a patched version of Microweber above version 2.0.0.
Who is affected by CVE-2023-6832?
CVE-2023-6832 affects all versions of Microweber prior to 2.0.0 where coupon code functionality is enabled.
What functions are compromised in CVE-2023-6832?
CVE-2023-6832 compromises the coupon code functionality allowing unauthorized users to exploit the API to purchase items.
Is there a workaround for CVE-2023-6832?
A temporary workaround for CVE-2023-6832 is to ensure that the coupon code functionality is completely disabled in the application settings until an upgrade is performed.