Threats tagged 'ghsa-h4fr-vqpq-mpm6'

A Cross-Site Request Forgery (CSRF) vulnerability exists in the J2Store extension for Joomla affecting versions 1.0.0 through 3.3.22, 4.0.0 through 4.0.22, and 4.1.0 through 4.1.7. The flaw allows an attacker to forge requests during a victim's active checkout session to silently overwrite billing or shipping addresses before order confirmation or tamper with saved profile addresses. Exploitation requires user interaction and executes with the victim's session privileges, without cross-account data access.