CVE-2020-12101

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-04-30 · updated 2026-06-17
Weakness: CWE-276

Description

The address-management feature in xt:Commerce 5.1 to 6.2.2 allows remote authenticated users to zero out other user's stored addresses by manipulating an id field in the POST request for altering an address.

Affected products

Xt-Commerce: from 5.1.0 through 6.2.2

References

http://packetstormsecurity.com/files/157534/xt-Commerce-5.4.1-6.2.1-6.2.2-Improper-Access-Control.html
http://seclists.org/fulldisclosure/2020/May/0
https://helpdesk.xt-commerce.com/index.php?/Knowledgebase/Article/View/1784/294/adressbuch-sicherheitspatch-17042020-fr-xtcommerce-51-bis-622
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-012.txt
http://packetstormsecurity.com/files/157534/xt-Commerce-5.4.1-6.2.1-6.2.2-Improper-Access-Control.html
http://seclists.org/fulldisclosure/2020/May/0
https://helpdesk.xt-commerce.com/index.php?/Knowledgebase/Article/View/1784/294/adressbuch-sicherheitspatch-17042020-fr-xtcommerce-51-bis-622
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-012.txt

Get alerted when CVE-2020-12101 or the next vulnerability affects your stack