CVE-2023-36238: Insecure Direct Object Reference (IDOR) in Bagisto
Summary
CVE-2023-36238: Bagisto vulnerable to Insecure Direct Object Reference (IDOR). Affects bagisto/bagisto versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Bagisto is an open-source e-commerce platform built on Laravel. It provides a range of features for creating online stores. The vulnerability in Bagisto version 1.5.0 is related to Insecure Direct Object Reference (IDOR). This vulnerability allows an attacker to access sensitive information by manipulating the invoice ID parameter.
Vulnerability Detail
The Insecure Direct Object Reference (IDOR) vulnerability in Bagisto version 1.5.0 enables an attacker to bypass authorization and access sensitive information. By manipulating the invoice ID parameter, an attacker can retrieve confidential data that they are not authorized to access. This can lead to the exposure of customer information, financial data, or other sensitive details. The vulnerability has a moderate severity rating.
How To Fix
Minimum fixed version
1.3.2
This is the first release that contains the fix.
composer require bagisto/bagisto:1.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is advised to upgrade to the fixed version as soon as possible to mitigate the risk of unauthorized access to sensitive information.
Conclusion
In conclusion, Bagisto version 1.5.0 is vulnerable to an Insecure Direct Object Reference (IDOR) issue. This vulnerability allows unauthorized access to sensitive information by manipulating the invoice ID parameter. To mitigate the risk, it is crucial to upgrade to Bagisto version 1.3.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for bagisto/bagisto →
FAQ
Bagisto is an open-source e-commerce platform built on Laravel. It provides a range of features for creating online stores.
Insecure Direct Object Reference (IDOR) is a vulnerability that allows an attacker to bypass authorization and access sensitive information by manipulating object references.
This vulnerability allows an attacker to obtain sensitive information by manipulating the invoice ID parameter. It can lead to the exposure of confidential data, such as customer information and financial details.
To fix this vulnerability, it is recommended to upgrade to Bagisto version 1.3.2 or later. Ensure proper authorization checks and validate user access to sensitive resources.
There is no specific workaround mentioned for this vulnerability. Upgrading to the fixed version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for bagisto/bagisto.
