CVE-2023-6832: Business Logic Errors in microweber/microweber
Summary
CVE-2023-6832: Business Logic Errors in microweber/microweber. Affects microweber/microweber versions < 2.0.0. Fixed in 2.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Microweber is an open-source content management system (CMS) that allows users to create and manage websites. It provides a range of features, including e-commerce functionality with the ability to apply coupon codes for discounts. However, a vulnerability has been identified in microweber where users can exploit the coupon code functionality to obtain items at a lower price, even if the admin has disabled its use.
Vulnerability Detail
The vulnerability in microweber allows users to bypass the disabled coupon code functionality and still make purchases with a coupon code. By sending requests to the API that handles the coupon code, users can exploit this business logic error and obtain items at a reduced price. This can lead to financial loss for the website owner and potential misuse of the system. The vulnerability has a CVSS score of 6.0, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.0.0
This is the first release that contains the fix.
composer require microweber/microweber:2.0.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, website owners can mitigate the risk by regularly updating microweber to the latest version and ensuring the coupon code functionality is properly configured and monitored.
Conclusion
In conclusion, the vulnerability in microweber allows users to bypass the disabled coupon code functionality and obtain items at a lower price. To mitigate this risk, it is important to update microweber to the latest version and properly configure the coupon code functionality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for microweber/microweber →
FAQ
Microweber is an open-source content management system (CMS) that allows users to create and manage websites.
The vulnerability allows users to exploit the coupon code functionality and obtain items at a lower price, even if the admin has disabled its use. This can lead to financial loss for the website owner and potential misuse of the system.
To fix this vulnerability, update microweber to version 2.0 or later. Follow the upgrade instructions provided by the project.
There is no specific workaround mentioned. However, regularly updating microweber and properly configuring the coupon code functionality can mitigate the risk.
The vulnerability has a CVSS score of 6.0, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for microweber/microweber.
