CVE-2020-27997

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-02-19 · updated 2026-06-17
Weakness: CWE-352

Description

An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery (CSRF) protection may lead to elevation of privileges (e.g., /admin/customer/create to create an admin account).

Affected products

Smartstorenet: before 4.1.0 — fixed in 4.1.0

How to fix

Upgrade to a fixed version: Smartstorenet 4.1.0. Check the vendor advisory for mitigations.

References

https://github.com/smartstore/SmartStoreNET/compare/4.0.1...4.1.0
https://securitylab.github.com/advisories/GHSL-2020-138-139-SmartstoreAG-SmartStoreNET
https://github.com/smartstore/SmartStoreNET/compare/4.0.1...4.1.0
https://securitylab.github.com/advisories/GHSL-2020-138-139-SmartstoreAG-SmartStoreNET

Get alerted when CVE-2020-27997 or the next vulnerability affects your stack