4.3
MediumCVSS 3.1 · from VulnCheck
CVE-2021-47953
OpenCart 3.0.3.7 Cross-Site Request Forgery via account/password
OpenCart · Cross-site request forgery · CWE-352AffectedOpenCart
FixNo fix listed yet.
PublishedMay 10, 12:52 · VulnCheck
ScoredMay 10 · 4.3 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:11 UTC
What we know
No known exploitation. CISA KEV, checked 22:11 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick authenticated users into submitting hidden forms with new password values in the 'password' and 'confirm' parameters to hijack accounts.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed inOpenCart3.0.3.7–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known