CVE-2020-27997

Name of the Vulnerable Software and Affected Versions SmartStoreNET versions prior to 4.1.0

Description The issue is related to a lack of Cross Site Request Forgery (CSRF) protection, which may lead to elevation of privileges. For example, an attacker could exploit this issue to create an admin account using the /admin/customer/create endpoint.

Recommendations For versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /admin/customer/create endpoint to minimize the risk of exploitation.