CVE-2023-3229 : Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.

Business Logic Errors in GitHub repository fossbilling/fossbilling prior to 0.5.0.

Published 2023-06-14 06:15:09

Updated 2023-06-17 01:42:14

Source huntr.dev

View at NVD, CVE.org

Products affected by CVE-2023-3229

Fossbilling » Fossbilling
Versions before (<) 0.5.0
cpe:2.3:a:fossbilling:fossbilling:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 34 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	2.8	2.5	huntr.dev
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: Low Availability: None
6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

https://huntr.dev/bounties/31f48ca1-e5e8-436f-b779-cad597759170

we still can order the product even it is disabled vulnerability found in fossbilling
Exploit;Patch;Third Party Advisory
https://github.com/fossbilling/fossbilling/commit/56a64fefddf6a0b06304bdd443fdb0bb55423533

Prevent checkouts with disabled products (#1308) · FOSSBilling/FOSSBilling@56a64fe · GitHub
Patch

Jump to