CVE-2023-6832: Business Logic Errors in microweber/microweber
First published: Fri Dec 15 2023(Updated: )
A vulnerability has been identified in microweber where users can purchase items with a coupon code. If the admin disables the use of the coupon code functionality, but the user sends requests to the API that handles the coupon code, the user can exploit the vulnerability and obtain items at a lower price.
Credit: security@huntr.dev
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/microweber/microweber | <2.0.0 | 2.0.0 |
| Microweber WHMCS | <2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-6832?
CVE-2023-6832 has been classified with a moderate severity level due to potential unauthorized coupon code exploitation.
How do I fix CVE-2023-6832?
To fix CVE-2023-6832, ensure that you upgrade to a patched version of Microweber above version 2.0.0.
Who is affected by CVE-2023-6832?
CVE-2023-6832 affects all versions of Microweber prior to 2.0.0 where coupon code functionality is enabled.
What functions are compromised in CVE-2023-6832?
CVE-2023-6832 compromises the coupon code functionality allowing unauthorized users to exploit the API to purchase items.
Is there a workaround for CVE-2023-6832?
A temporary workaround for CVE-2023-6832 is to ensure that the coupon code functionality is completely disabled in the application settings until an upgrade is performed.
- collector/github-advisory-latest
- alias/GHSA-qjfx-fvx7-3wvw
- alias/CVE-2023-6832
- collector/github-advisory
- agent/references
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- agent/severity
- agent/weakness
- agent/title
- agent/event
- agent/description
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-api
- agent/author
- package-manager/composer
- vendor/microweber
- canonical/microweber whmcs