Lucene search

MitreCVE-2020-9009

HistoryApr 11, 2023 - 9:15 p.m.

CVE-2020-9009

2023-04-1121:15:10

CWE-862

mitre

web.nvd.nist.gov

cve-2020-9009

shipstation.com

cs-cart

plugin

remote attack

database vulnerability

nvd

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

48.9%

JSON

The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database (via action=shipnotify) because access to this endpoint is completely unchecked. The attacker must guess an order number.

Affected configurations

Nvd

Node

shipstationshipstationRange≤1.1cs-cart

VendorProductVersionCPE
shipstationshipstation*cpe:2.3:a:shipstation:shipstation:*:*:*:*:*:cs-cart:*:*

Vendor	Product	Version	CPE
shipstation	shipstation	*	cpe:2.3:a:shipstation:shipstation::::::cs-cart::*

References

help.shipstation.com/hc/en-us/articles/360025855352-CS-Cart

www.jerdiggity.com/node/870

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

AI Score

4.4

Confidence

High

EPSS

0.001

Percentile

48.9%

JSON

Related for CVE-2020-9009