Lucene search

VulDBCVE-2024-6128

HistoryJun 18, 2024 - 9:15 p.m.

CVE-2024-6128

2024-06-1821:15:56

CWE-841

VulDB

web.nvd.nist.gov

spa-cartcms

checkout page

vulnerability

behavioral workflow

file processing

remote attack

exploit

vdb-268895

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/VI:L/SI:N/VA:N/SA:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

21.0%

JSON

A vulnerability, which was classified as problematic, has been found in spa-cartcms 1.9.0.6. This issue affects some unknown processing of the file /checkout of the component Checkout Page. The manipulation of the argument quantity with the input -10 leads to enforcement of behavioral workflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-268895.

Affected configurations

Nvd

Vulners

Vulnrichment

Node

spa-cartspa-cartcmsMatch1.9.0.6

VendorProductVersionCPE
spa-cartspa-cartcms1.9.0.6cpe:2.3:a:spa-cart:spa-cartcms:1.9.0.6:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
spa-cart	spa-cartcms	1.9.0.6	cpe:2.3:a:spa-cart:spa-cartcms:1.9.0.6:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "spa-cartcms",
    "versions": [
      {
        "version": "1.9.0.6",
        "status": "affected"
      }
    ],
    "modules": [
      "Checkout Page"
    ]
  }
]

References

msecureltd.blogspot.com/2024/04/friday-fun-pentest-series-5-spa.html

seclists.org/fulldisclosure/2024/Jun/6

vuldb.com/?ctiid.268895

vuldb.com/?id.268895

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS4

6.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/SC:N/VI:L/SI:N/VA:N/SA:N

AI Score

5.4

Confidence

High

EPSS

0.001

Percentile

21.0%

JSON

Related for CVE-2024-6128