~ / search / GHSA-vpq7-m4qm-p2gp

GHSA-vpq7-m4qm-p2gp

Microweber vulnerable to Improper Validation of Specified Quantity in Input

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-0596

Packages

EcosystemPackageAffectedFixed in
Packagist microweber/microweber < 1.2.11 1.2.11

Details

As written in the advisory (Markdown source, shown as plain text).

Microweber prior to version 1.2.11 can have a negative product amount. This could allow an attacker to manipulate the total value and get products for free.

References

External links from the advisory. They lead to third-party sites.