Smartstore Smartstorenet
5 CVEs affecting Smartstore Smartstorenet. Latest disclosed: 2021-05-19. Critical: 2, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-36364 | Critical | 9.1 | 2021-05-19 | An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal (for copy and dele… |
CVE-2020-15243 | Critical | 9.1 | 2020-10-08 | Affected versions of Smartstore have a missing WebApi Authentication attribute. This vulnerability affects Smartstore shops in version 4.0.0 & 4.0.1 which have… |
CVE-2020-27997 | High | 8.8 | 2021-02-19 | An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery (CSRF) protection may lead to elevation of privileges (e.g., /admin/c… |
CVE-2020-27996 | High | 8.8 | 2020-10-29 | An issue was discovered in SmartStoreNET before 4.0.1. It does not properly consider the need for a CustomModelPartAttribute decoration in certain ModelBase.Cu… |
CVE-2020-36365 | Medium | 6.1 | 2021-05-19 | Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open re… |