CVE-2020-15109

Katalog CVE

CVSS 5.3 · Medium EPSS 1,00%

Kerentanan Improper Input Validation pada nebulab solidus. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there is an bility to change order address without triggering address validations. This vulnerability allows a malicious customer to craft request data with parameters that allow changing the address of the current order without changing the shipment costs associated with the new shipment. All stores with at least two shipping zones and different costs of shipment per zone are impacted. This problem comes from how checkout permitted attributes are structured. We have a single list of attributes that are permitted across the whole checkout, no matter the step that is being submitted. See the linked reference for more information. As a workaround, if it is not possible to upgrade to a supported patched version, please use this gist in the references section.

Rincian

Terbit di NVD

4 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-862: Missing Authorization

EPSS (30 hari)

1,00% peluang dieksploitasi; lebih tinggi dari 61,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/kennyadsl/4618cd9797984cb64f7700a81bda889d patch · advisory pihak ketiga
• https://github.com/solidusio/solidus/security/advisories/GHSA-3mvg-rrrw-m7ph exploit · advisory pihak ketiga