PT-2021-10595
CVE-2020-21139
·
تاريخ النشر
2021-11-04
·
تاريخ التحديث
2021-11-05
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions:
EC Cloud E-Commerce System version 1.3
Description:
The issue allows attackers to arbitrarily add admin accounts via the /admin.html?do=user&act=add endpoint. This is due to a Cross-Site Request Forgery (CSRF) in the EC Cloud E-Commerce System.
Recommendations:
For EC Cloud E-Commerce System version 1.3, as a temporary workaround, consider restricting access to the /admin.html?do=user&act=add endpoint until a patch is available. Avoid using the
do and act parameters in this endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾