CVE-2023-36331

n/a / n/a PUBLISHED

Description (CNA)

Incorrect access control in the /member/orderList API of xmall v1.1 allows attackers to arbitrarily access other users' order details via manipulation of the query parameter userId.

Affected (CNA)

Vendor / product	Versions
n/a / n/a	affected n/a

CWE

No CWE identifiers supplied.

References

https://github.com/Exrick/xmall/issues/100

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.