Description

Unrestricted file upload (RCE) in express-cart module before 1.1.7 allows a privileged user to gain access in the hosting machine.

Remediation

References

https://hackerone.com/reports/343726

Related Vulnerabilities

CVE-2022-24723 Vulnerability in npm package urijs

CVE-2022-24431 Vulnerability in npm package abacus-ext-cmdline

CVE-2020-7625 Vulnerability in npm package op-browser

CVE-2022-43422 Vulnerability in maven package com.compuware.jenkins:compuware-topaz-utilities

CVE-2020-28453 Vulnerability in npm package npos-tesseract

Severity

Critical

Classification

CWE-434 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Exploit Patch Third Party Advisory