Mitch_45

**Name of the Vulnerable Software and Affected Versions** Webkul Bagisto versions prior to 2.4.5 **Description** An authorization bypass exists in the Configuration Management component. A remote attacker can exploit this by manipulating the `action` argument within the '/admin/configuration/cache-management/execute' endpoint. **Recommendations** Update Webkul Bagisto to version 2.4.5 or later. As a temporary mitigation, restrict access to the '/admin/configuration/cache-management/execute' endpoint.

**Name of the Vulnerable Software and Affected Versions** Webkul Bagisto versions prior to 2.4.5 **Description** A remote issue exists in the `/customer/account/rma/store` file. Manipulation of the `rma qty`, `resolution type`, or `rma reason id` arguments allows for the enforcement of a behavioral workflow. **Recommendations** Update Webkul Bagisto to version 2.4.5 or later. As a temporary mitigation, restrict access to the `/customer/account/rma/store` endpoint.

**Name of the Vulnerable Software and Affected Versions** Webkul Bagisto versions prior to 2.4.5 **Description** An authorization bypass exists in the Backend Reporting Endpoint component within the `/admin/reporting/sales/` file. This flaw allows remote attackers to bypass authorization mechanisms through manipulation of the affected endpoint. **Recommendations** Update Webkul Bagisto to a version newer than 2.4.4. Restrict access to the `/admin/reporting/sales/` endpoint as a temporary mitigation measure.