CVE-2020-23360 Auth bypass in n/a
Attackers can bypass password confirmation checks during registration or reset, potentially leading to unauthorized account access.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-23360?
CVE-2020-23360 is a critical authentication bypass vulnerability in Oscommerce Oscommerce, published on 27 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.php
Weakness: CWE-697
Which versions are affected by CVE-2020-23360?
It affects 1 product.
Products include Oscommerce Oscommerce.
How do I fix CVE-2020-23360?
No fix has been published for CVE-2020-23360 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-23360 being exploited?
There is no known exploitation of CVE-2020-23360 in the wild and no public exploit code.
Other vulnerabilities in Oscommerce Oscommerce
- CVE-2020-27976 Command injection in n/a
- CVE-2019-25495 osCommerce 2.3.4.1 SQL Injection via reviews_id Parameter
- CVE-2019-25496 osCommerce 2.3.4.1 SQL Injection via products_id Parameter
- CVE-2019-25497 osCommerce 2.3.4.1 SQL Injection via currency Parameter
- CVE-2020-27975 Cross-site request forgery in n/a
Sources
Also known as GHSA-8f6m-8258-hw32.