GitHub Advisoryadvisory · Packagist

GHSA-jwqr-jcwp-445w OpenCart Cross-Site Request Forgery (CSRF)

HIGH Published 2022-05-14 Modified 2024-04-23 Official page ↗
Aliases
CVE-2018-13067
Ecosystem
Packagist
Packages
opencart/opencart
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-352
Reviewed
2024-04-23

Affected packages

• Packagist opencart/opencart: <= 3.0.2.0 (no fix yet)

Description

`/upload/catalog/controller/account/password.php` in OpenCart through 3.0.2.0 has CSRF via the `index.php?route=account/password` URI to change a user's password.

Related

Alias · CVE (1)

  • CVE-2018-13067 /upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References