PT-2026-102405
CVE-2026-102362
·
تاريخ النشر
2026-09-28
·
تاريخ التحديث
2026-09-29
الوصف من
CVSS 4.0
6.9
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
mall4j versions prior to 4.1
Description
The software fails to implement authentication controls on the 'DELETE /prodComm' endpoint within the
ProdCommController. This allows unauthenticated attackers to delete arbitrary product reviews by providing the prodCommId parameter without undergoing authorization checks.Recommendations
Update mall4j to a version later than 4.0.
As a temporary workaround, restrict access to the 'DELETE /prodComm' endpoint to prevent unauthorized deletions.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾