Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 3 June 2019.

Which products and versions are affected?

express-cart (npm) SEMVER:introduced=0,fixed=1.1.6.

Is there a fix for This vulnerability?

Yes. express-cart (npm): upgrade to 1.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run express-cart (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

mrvautin express-cart privilege escalation

Severity: low · CVSS 3.1 · Published 2019-06-03

express-cart is an open-source e-commerce shopping cart platform. A security flaw allows any user to bypass access controls and create new administrator accounts. This could lead to a complete takeover of the online store, allowing unauthorized individuals to access customer data, modify orders, or disrupt business operations.

Technologies: express-cart (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 3 June 2019.
Which products and versions are affected?: express-cart (npm) SEMVER:introduced=0,fixed=1.1.6.
Is there a fix for This vulnerability?: Yes. express-cart (npm): upgrade to 1.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run express-cart (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

express-cart (npm): upgrade to 1.1.6 or later
```
npm install express-cart@1.1.6
```

Technical details

A privilege escalation vulnerability exists in express-cart versions prior to 1.1.6 due to insufficient access control checks during user creation. An attacker can exploit this by sending a crafted request to the user registration or management endpoints, potentially by manipulating the referrer or other request parameters to bypass authorization logic. Successful exploitation allows a remote attacker to create a new user with administrative privileges. This results in a complete compromise of the application's integrity and confidentiality. The issue was addressed in version 1.1.6 by improving the validation of administrative user creation.

Affected products

mrvautin express-cart < 1.1.6

Timeline

2018-07-12: disclosed: Vulnerability disclosed via HackerOne report 343626
2019-06-03: advisory: GitHub Advisory published
2026-02-03: other: Advisory withdrawn as a duplicate of GHSA-hr89-w7p6-pjmq

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.