Code execution in evershop

Description

An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code via the /deleteCustomer/route.json file.

Recommendation

Update the @evershop/evershop package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.0.0-rc.8
• Patched version(s): 1.0.0-rc.8

References

• GHSA-5mmr-9qx3-3pf9
• devhub.checkmarx.com
• CVE-2023-46498
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Directory Traversal in evershop - @evershop/evershop - GHSA-4wrm-qmq2-5fjx - CVE-2023-46493
• Cross-site Scripting in evershop - @evershop/evershop - GHSA-2xcj-557c-hf8r - CVE-2023-46495
• Cross Site Scripting in evershop - @evershop/evershop - CVE-2023-46494
• Directory Traversal in evershop - @evershop/evershop - CVE-2023-46496

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

@evershop/evershop