Description
expressCart before 1.1.6 allows remote attackers to create an admin user via a /admin/setup Referer header.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | express-cart | < 1.1.6 | 1.1.6 | GHSA-hr89-w7p6-pjmq |
High · 8.8
CVE-2018-12457
EUVD-2022-4201GHSA-hr89-w7p6-pjmq
express-cart allows any user to create an admin user
Published Jun 15, 2018 · Updated Sep 16, 2024 · Assigned by mitre