CVE-2024-53476

Katalog CVE

CVSS 5.9 · Medium EPSS 0,63%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). Skor CVSS 3.1 5.9 (Medium) menurut CISA ADP.

Deskripsi (NVD)

A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory restrictions by simultaneously submitting purchase requests from multiple accounts for the same product. This can lead to overselling when stock is limited, as the system fails to accurately track inventory under high concurrency, resulting in potential loss and unfulfilled orders.

Rincian

Terbit di NVD

27 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

5.9 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,6% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/AbdullahAlmutawa/CVE-2024-53476
• https://github.com/simplcommerce/SimplCommerce
• https://github.com/simplcommerce/SimplCommerce/issues/1111