Business Logic Errors Affecting microweber/microweber package, versions <2.0.0
Threat Intelligence
Exploit Maturity
Mature
EPSS
0.04% (15th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-MICROWEBERMICROWEBER-6128858
- published 15 Dec 2023
- disclosed 15 Dec 2023
- credit lujiefsi
Introduced: 15 Dec 2023
CVE-2023-6832 Open this link in a new tabHow to fix?
Upgrade microweber/microweber to version 2.0.0 or higher.
Overview
microweber/microweber is a new generation CMS with drag and drop.
Affected versions of this package are vulnerable to Business Logic Errors due to improper handling of certain conditions within the coupon code application logic. An user can send requests to the API that handles the coupon code, obtaining items at a lower price. Note:
This is only exploitable if the admin disables the use of the coupon code functionality.
References
CVSS Scores
version 3.1