CVE-2019-16403

Published: Sep 18, 2019Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.

Affected (1)

Products: Webkul: Bagisto

Webkul

1 product

Bagisto

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Webkul Bagisto	Before 0.1.5

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://github.com/bagisto/bagisto/issues/749

Source: cve@mitre.org

ExploitThird Party Advisory

https://github.com/bagisto/bagisto/issues/749

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

Timeline

No history available yet.