GCVE - cpe:2.3:a:smartstore:smartstorenet:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:smartstore:smartstorenet:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Smartstore (`2e10ded2-c80c-5a58-8132-0ed0756b52ab`)
Product	Smartstorenet (`50b69f78-d2ae-57b6-85c4-c97a63157d93`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/smartstore/smartstorenet`	purl2cpe	2026-06-01 10:12:34.029411

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-36365`	vulnerable	2026-06-08 05:25:02.986425	Details available Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect. Published: 2021-05-19T18:57:46.000Z Updated: 2024-08-04T17:23:10.435Z Open on db.gcve.eu Reference links https://github.com/smartstore/SmartStoreNET/issues/2113	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-36364`	vulnerable	2026-06-08 05:25:02.985873	Details available An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal (for copy and delete actions) in the ImportController.Create method via a TempFileName field. Published: 2021-05-19T18:57:20.000Z Updated: 2024-08-04T17:23:10.430Z Open on db.gcve.eu Reference links https://github.com/smartstore/SmartStoreNET/commit/5ab1e37dc8d6415d04354e1a116f3d82e9555f5c https://github.com/smartstore/SmartStoreNET/issues/2112	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-27997`	vulnerable	2026-06-08 05:23:53.646706	Details available An issue was discovered in SmartStoreNET before 4.1.0. Lack of Cross Site Request Forgery (CSRF) protection may lead to elevation of privileges (e.g., /admin/customer/create to create an admin account). Published: 2021-02-19T23:00:25.000Z Updated: 2024-08-04T16:25:44.094Z Open on db.gcve.eu Reference links https://github.com/smartstore/SmartStoreNET/compare/4.0.1...4.1.0 https://securitylab.github.com/advisories/GHSL-2020-138-139-SmartstoreAG-SmartStoreNET	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-27996`	vulnerable	2026-06-08 05:23:53.646278	Details available An issue was discovered in SmartStoreNET before 4.0.1. It does not properly consider the need for a CustomModelPartAttribute decoration in certain ModelBase.CustomProperties situations. Published: 2020-10-29T17:07:54.000Z Updated: 2024-08-04T16:25:43.967Z Open on db.gcve.eu Reference links https://github.com/smartstore/SmartStoreNET/commit/8702c6140f4fc91956ef35dba12d24492fb3f768 https://github.com/smartstore/SmartStoreNET/compare/4.0.0...4.0.1 https://securitylab.github.com/advisories/GHSL-2020-138-139-SmartstoreAG-SmartStoreNET	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-15243`	vulnerable	2026-06-08 05:19:25.578952	WebApi Authentication attribute missing in Smartstore CRITICAL (9.1) Affected versions of Smartstore have a missing WebApi Authentication attribute. This vulnerability affects Smartstore shops in version 4.0.0 & 4.0.1 which have installed and activated the Web API plugin. Users of Smartstore 4.0.0 and 4.0.1 must merge their repository with 4.0.x or overwrite the file SmartStore.Web.Framework in the /bin directory of the deployed shop with this file. As a workaround without updating uninstall the Web API plugin to close this vulnerability. Published: 2020-10-08T22:40:12.000Z Updated: 2024-08-04T13:08:23.167Z Open on db.gcve.eu Reference links https://github.com/smartstore/SmartStoreNET/security/advisories/GHSA-8g9m-jx26-qp4h	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.