CVE-2022-27461

MediumCVSS 6.1

Published: 04/05/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.68%

48th percentile - higher than 48% of all known CVEs

Summary

In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.

Risk Assessment

The risk involves potential phishing attacks where users may be redirected to a malicious external site, leading to credential theft or exposure of sensitive information.

Recommendation

It is recommended to upgrade nopCommerce to the latest version that includes a fix for the open redirect vulnerability. Additionally, implement validation and restrict allowed URLs in redirect parameters.

Original NVD description (English source)

In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.