CVE-2023-46498

The vulnerability is related to the /deleteCustomer/route.json file available in the EverShop application. A remote attacker can access this resource without authorization, which leads to disclosure of sensitive data and allows execution of arbitrary code on the server. The detailed mechanism of the vulnerability was not disclosed in the CVE description, however the CVSS vector indicates no requirements for permissions and user interaction.

An attacker can gain access to sensitive information stored in the application and execute arbitrary code on the server (RCE), which may result in complete takeover of the system.

EverShop NPM should be updated to version v.1.0.0-rc.8 or newer. Until the update is deployed, it is recommended to restrict access to the application at the firewall level and monitor network traffic for unauthorized requests to customer management endpoints.

EverShop NPM in versions before v.1.0.0-rc.8