Murrez

**Name of the Vulnerable Software and Affected Versions** J2Store versions 1.0.0 through 3.3.20 J2Store versions 4.0.0 through 4.0.20 J2Store versions 4.1.0 through 4.1.5 **Description** An authenticated user possessing a valid order token can manipulate the download limit counter of a download record associated with a different order. This issue is caused by a lack of proper authorization checks and the absence of a CSRF (Cross-Site Request Forgery) token, which is a mechanism used to prevent unauthorized commands from being transmitted from a user that the web application trusts. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** J2Store versions 1.0.0 through 3.3.20 J2Store versions 4.0.0 through 4.0.20 J2Store versions 4.1.0 through 4.1.5 **Description** An unauthenticated visitor can access the full checkout confirmation page of an order, exposing sensitive data such as line items, prices, and totals. This occurs when a user provides an arbitrary `order id` as a query parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** J2Store versions 1.0.0 through 3.3.20 J2Store versions 4.0.0 through 4.0.20 J2Store versions 4.1.0 through 4.1.5 **Description** An authenticated user can replicate orders from other customers by providing a different customer's `order id`. This allows the attacker to copy the cart contents and address data into their own session because the system validates the CSRF (Cross-Site Request Forgery) token but fails to verify if the user owns the requested order. **Recommendations** Update J2Store versions 1.0.0 through 3.3.20 to a version newer than 3.3.20. Update J2Store versions 4.0.0 through 4.0.20 to a version newer than 4.0.20. Update J2Store versions 4.1.0 through 4.1.5 to a version newer than 4.1.5.

**Name of the Vulnerable Software and Affected Versions** J2Store versions 1.0.0 through 3.3.20 J2Store versions 4.0.0 through 4.0.20 J2Store versions 4.1.0 through 4.1.5 **Description** An open redirect exists in the cart controller where four task handlers accept a base64-encoded URL from user input and redirect to it without validating the destination host. This allows attackers to perform phishing attacks by leveraging the trusted domain of the shop. No authentication is required to exploit this issue. **Recommendations** Update J2Store versions 1.0.0 through 3.3.20 to a version newer than 3.3.20. Update J2Store versions 4.0.0 through 4.0.20 to a version newer than 4.0.20. Update J2Store versions 4.1.0 through 4.1.5 to a version newer than 4.1.5.

**Name of the Vulnerable Software and Affected Versions** Convert Forms versions prior to 5.2.5 **Description** The front-end Submissions view fails to enforce proper access control, allowing a client-controlled validation bypass. This flaw enables an unauthenticated visitor to list the submissions of a form. **Recommendations** Update to version 5.2.5 or later.

**Name of the Vulnerable Software and Affected Versions** SP Page Builder versions prior to 6.8.0 **Description** An unauthenticated attacker can create comments on instances where guest commenting is disabled. This is achieved by overriding the configuration setting using user-supplied input. **Recommendations** Update SP Page Builder to version 6.8.0 or later.