p PatchFirst

CVE-2025-12919

CVE-2025-12919 · EverShop Order Order.resolvers.js resource injection

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

A vulnerability was detected in EverShop up to 2.0.1. Affected is an unknown function of the file /src/modules/oms/graphql/types/Order/Order.resolvers.js of the component Order Handler. The manipulation of the argument uuid results in improper control of resource identifiers. The attack may be performed from remote. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 6.3 · Moyenne · EPSS 0,5%

Publication
Mise à jour

Pile logicielle: node

Produits et versions concernés

  • evershop

    Versions du logiciel
    • 2.0.0: Concernée
    • 2.0.1: Concernée

    Aucun correctif publié

  • @evershop/evershop npm

    Plages de versions concernées
    • SEMVER: ≤ 2.1.0

    Aucun correctif publié

Sources originales

Vérifiez votre serveur →