CVE-2020-11007: Negative charge in shopping cart in Shopizer
Summary
CVE-2020-11007: Negative charge in shopping cart in Shopizer. Affects com.shopizer:sm-core-model versions < 2.11.0. Fixed in 2.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shopizer is an open-source e-commerce platform written in Java. It provides a range of features for building and managing online stores. The 'com.shopizer:sm-core-model' package is a core component of Shopizer, responsible for handling shopping cart functionality and order processing.
Vulnerability Detail
The vulnerability (CVE-2020-11007) in Shopizer allows for the creation of incorrect shopping carts and order totals due to inadequate validation of negative quantity inputs. This vulnerability can be exploited through the API or Controller based versions of Shopizer. An attacker can manipulate the quantity parameter to set a negative value, resulting in incorrect calculations and potentially leading to financial loss for the affected online store.
How To Fix
Latest published version: 3.2.3 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.11.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not feasible, a temporary workaround is to manually apply the fixes made in the relevant files. Alternatively, the javax constraint validation can be used on the quantity parameter to ensure it is not negative.
Conclusion
The vulnerability in Shopizer (CVE-2020-11007) allows for the creation of incorrect shopping carts and order totals due to inadequate validation of negative quantity inputs. To mitigate this vulnerability, it is recommended to upgrade to Shopizer version 2.11.0 or later. If upgrading is not possible, manual fixes or the use of javax constraint validation can be employed. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for com.shopizer:sm-core-model →
FAQ
The vulnerability allows for the creation of incorrect shopping carts and order totals, potentially leading to financial loss for the affected online store.
To fix this vulnerability, upgrade to Shopizer version 2.11.0 or later. Alternatively, manually apply the fixes made in the relevant files or use javax constraint validation on the quantity parameter.
Yes, if upgrading is not possible, you can apply the fixes manually or use javax constraint validation on the quantity parameter.
Yes, you can refer to the OWASP Input Validation Cheat Sheet and the Java EE tutorial on bean validation. Additionally, the GitHub commits with the fixes provide more technical details.
The vulnerability was found and solved by Yannick Gosset from Aix-Marseille University cybersecurity master program, under the supervision of Yassine Ilmi.
