Threats tagged 'ghsa-63f7-xmj7-pjgf'

A vulnerability in Webkul Bagisto up to version 2.4.4 affects the Admin Customer Impersonation Feature, specifically in the /admin/customers/login-as-customer/ component. This flaw allows an attacker to manipulate an ID argument to bypass authorization remotely. The vendor has acknowledged the issue, confirming that some fixes have already been applied and others are planned for future releases. The vulnerability has a medium severity rating with a CVSS score of 4.7. Public exploit details have been disclosed, but no known exploitation in the wild has been reported.