CVE-2024-7067

Katalog CVE

CVSS 8.8 · High EPSS 0,77%

Kerentanan Deserialization of Untrusted Data pada shuttur ecommerce-laravel-bootstrap. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in kirilkirkov Ecommerce-Laravel-Bootstrap up to 1f1097a3448ce8ec53e034ea0f70b8e2a0e64a87. It has been rated as critical. Affected by this issue is the function getCartProductsIds of the file app/Cart.php. The manipulation of the argument laraCart leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The name of the patch is a02111a674ab49f65018b31da3011b1e396f59b1. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-272348.

Rincian

Terbit di NVD

24 Juli 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/commit/a02111a674ab49f65018b31da3011b1e396f59b1 patch
• https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18 exploit · issue tracking · patch
• https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18#issuecomment-2192470359 exploit · issue tracking · patch
• https://github.com/kirilkirkov/Ecommerce-Laravel-Bootstrap/issues/18#issuecomment-2206863135 exploit · issue tracking · patch
• https://vuldb.com/?submit.378780 advisory pihak ketiga · vdb entry
• https://vuldb.com/?ctiid.272348 permissions required
• https://vuldb.com/?id.272348 permissions required