Threats tagged 'ghsa-7jj7-hfg8-m26w'

CoreShop versions up to 1.5.5 contain an authorization bypass vulnerability in the OrderController. Authenticated customers can manipulate user-controlled IDs to act on orders belonging to other customers. This includes confirming receipt of others' orders and overwriting return tracking details by supplying crafted parameters in OrderConfirm or SendReship functions.