CVE-2025-50850

{"id": "CVE-2025-50850", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.7, "exploitabilityScore": 3.9}]}, "published": "2025-07-31T16:15:31.163", "references": [{"url": "http://cs.com", "tags": ["Not Applicable"], "source": "cve@mitre.org"}, {"url": "https://github.com/hackerwahab/CS-Cart-Vulns/blob/main/CVE-2025-50850.md", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-804"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in CS Cart 4.18.3 allows the vendor login functionality lacks essential security controls such as CAPTCHA verification and rate limiting. This allows an attacker to systematically attempt various combinations of usernames and passwords (brute-force attack) to gain unauthorized access to vendor accounts. The absence of any blocking mechanism makes the login endpoint susceptible to automated attacks."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en CS Cart 4.18.3 que permite que la funci\u00f3n de inicio de sesi\u00f3n del proveedor carezca de controles de seguridad esenciales, como la verificaci\u00f3n CAPTCHA y la limitaci\u00f3n de velocidad. Esto permite que un atacante intente sistem\u00e1ticamente diversas combinaciones de nombres de usuario y contrase\u00f1as (ataque de fuerza bruta) para obtener acceso no autorizado a las cuentas del proveedor. La ausencia de cualquier mecanismo de bloqueo hace que el endpoint de inicio de sesi\u00f3n sea vulnerable a ataques automatizados."}], "lastModified": "2025-08-06T16:34:48.977", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cs-cart:cs-cart:4.18.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "697E87F8-685B-468D-8876-535E807BA897"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}