7.3
CVSS 3.1
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката може да се автоматизира
Описание
Оригинално описание
EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses. Attackers who know customer and address UUIDs can send POST, PATCH, or DELETE requests to /api/customers/:customer_id/addresses routes to add, modify, or delete saved shipping addresses.
Засегнати продукти
- evershopcommerce evershop: 1.2.2 преди 2.2.1; 2.2.1
Вид слабост
История
- 22 октомври 2026 Публикувано
Други уязвимости в evershopcommerce evershop
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-115323
- https://nvd.nist.gov/vuln/detail/CVE-2026-115323
- https://github.com/evershopcommerce/evershop/issues/928
- https://github.com/evershopcommerce/evershop/commit/af6e6fd935c4194668b11a924b847542598941f7
- https://github.com/evershopcommerce/evershop/releases/tag/v2.2.1
- https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/updateCustomerAddress/updateCustomerAddress.js
- https://github.com/evershopcommerce/evershop/blob/v2.1.2/packages/evershop/src/modules/customer/api/deleteCustomerAddress/route.json
- https://github.com/evershopcommerce/evershop
- https://www.vulncheck.com/advisories/evershop-1.2.2-before-2.2.1-missing-authorization-via-customer-address-api