Описание
mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.
Ссылки
EPSS
Процентиль: 19%
0.00285
Низкий
5.3 Medium
CVSS3
Дефекты
CWE-306
Связанные уязвимости
CVSS3: 5.3
github
14 дней назад
mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attackers can delete arbitrary product reviews by supplying the prodCommId parameter without authorization checks.
EPSS
Процентиль: 19%
0.00285
Низкий
5.3 Medium
CVSS3
Дефекты
CWE-306