CVE-2020-15243 - CVE House
Back to Database
Status published Critical CVE-2020-15243

WebApi Authentication attribute missing in Smartstore

Vulnerability Description

Affected versions of Smartstore have a missing WebApi Authentication attribute. This vulnerability affects Smartstore shops in version 4.0.0 & 4.0.1 which have installed and activated the Web API plugin. Users of Smartstore 4.0.0 and 4.0.1 must merge their repository with 4.0.x or overwrite the file SmartStore.Web.Framework in the */bin* directory of the deployed shop with this file. As a workaround without updating uninstall the Web API plugin to close this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15243

Credits & Attribution

No credits recorded in the NVD database.

References

More from smartstore

View All →
CVE-2021-32608
An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1....
Critical 9.8
CVE-2021-32607
An issue was discovered in Smartstore (aka SmartStoreNET) through 4.1.1....
Critical 9.8
CVE-2020-36365
Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and...
Medium 6.1
CVE-2020-36364
An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0....
Critical 9.1
CVE-2020-27997
An issue was discovered in SmartStoreNET before 4.1.0. Lack of...
High 8.8

Affected Vendor

Affected Software

SmartStoreNET
Vulnerable Versions:
>= 4.0.0, <= 4.0.1

Timeline

Official Publish: October 8th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access