1. Home
  2. CVE Database
  3. CVE-2020-11007
MEDIUM · 6.5

CVE-2020-11007

In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes...

Vulnerability Description

In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes it possible to create a negative total in the shopping cart. This has been patched in version 2.11.0.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
ShopizerShopizer< 2.11.0

Related Weaknesses (CWE)

CWE-20

References

FAQ

What is CVE-2020-11007?

CVE-2020-11007 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes...

How severe is CVE-2020-11007?

CVE-2020-11007 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-11007?

Check the references section above for vendor advisories and patch information. Affected products include: Shopizer Shopizer.