Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:thirtybees:thirty_bees:*:*:*:*:*:*:*:*

1 brief RSS
high advisory

Authentication Bypass in Thirty bees PasswordController

Thirty bees versions up to 1.7.0 are vulnerable to an authentication bypass in PasswordController::resolveCustomer() that enables account takeover via manipulated guest checkout processes.

Thirty bees authentication-bypass e-commerce account-takeover
1t 1c