CVE-2024-58248: Race Condition
nopCommerce through 4.90.1 does not offer locking for order placement. Thus there is a race condition with duplicate redeeming of gift cards.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58248?
The severity of CVE-2024-58248 is considered medium due to the potential for financial loss through race conditions in gift card redemption.
How do I fix CVE-2024-58248?
To fix CVE-2024-58248, upgrade to nopCommerce version 4.80.0 or later, which addresses the order placement locking issue.
What types of systems are affected by CVE-2024-58248?
CVE-2024-58248 affects all nopCommerce versions prior to 4.80.0 that facilitate order placements and gift card redemptions.
How does CVE-2024-58248 exploit the system?
CVE-2024-58248 exploits a race condition by allowing multiple simultaneous gift card redemptions, which can result in duplicated transactions.
Is there a workaround for CVE-2024-58248 before upgrading?
There are no official workarounds for CVE-2024-58248; the recommended action is to upgrade to the fixed version.