VulnerabilityDeferred

CVE-2024-50944

Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality.

CRITICAL 9.8EPSS 1.00%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.00%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality. The issue lies in the quantity parameter in the CartController's AddToCart method.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.00% probability · 61th percentile
CISA KEV: Not listed
Weakness: CWE-190
Source: cve@mitre.org

References

https://github.com/AbdullahAlmutawa/CVE-2024-50944
https://github.com/simplcommerce/SimplCommerce
https://github.com/simplcommerce/SimplCommerce/issues/1110
https://www.simplcommerce.com/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.