CVE-2020-11007 Negative charge in shopping cart possible in Shopizer

What is CVE-2020-11007?

CVE-2020-11007 is a medium-severity vulnerability in shopizer-ecommerce shopizer, published on 16 Apr 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In Shopizer before version 2.11.0, using API or Controller based versions negative quantity is not adequately validated hence creating incorrect shopping cart and order total. This vulnerability makes it possible to create a negative total in the shopping cart. This has been patched in version 2.11.0.

Weakness: CWE-20

Which versions are affected by CVE-2020-11007?

2 open source packages ship an affected version, including com.shopizer:sm-core-model. It affects 1 product.

Products include Shopizer Shopizer.

How do I fix CVE-2020-11007?

Upgrade com.shopizer:sm-core-model to 2.11.0 or later.

Is CVE-2020-11007 being exploited?

There is no known exploitation of CVE-2020-11007 in the wild and no public exploit code.

Other vulnerabilities in shopizer-ecommerce shopizer

• CVE-2020-11006 Potential remote code execution in Shopizer Critical 9.1
• CVE-2022-23063 Shopizer - Insufficient Session Expiration High 8.8
• CVE-2025-51605 Security feature bypass in n/a High 8.1
• CVE-2014-4963 Missing authorization in n/a Medium 6.8
• CVE-2014-4964 Cross-site request forgery in n/a Medium 6.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w8rc-pgxq-x2cj.