CVE-2022-27461
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.
Risk Assessment
The risk involves potential phishing attacks where users may be redirected to a malicious external site, leading to credential theft or exposure of sensitive information.
Recommendation
It is recommended to upgrade nopCommerce to the latest version that includes a fix for the open redirect vulnerability. Additionally, implement validation and restrict allowed URLs in redirect parameters.
Other vulnerabilities in nopCommerce
See all- CVE-2021-42193Medium
nopCommerce 4.40.3 is vulnerable to XSS in the Product Name field at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires.
- CVE-2022-33077High
An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.
Original NVD description (English source)
In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS