OpenCart Cross-Site Request Forgery (CSRF)

2022-05-1403:01:48

Google

osv.dev

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.0%

JSON

/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user’s password.

CPENameOperatorVersion
opencart/opencarteq3.0.1.2
opencart/opencarteq3.0.0.0
opencart/opencarteq3.0.1.1
opencart/opencarteq3.0.0.2
opencart/opencarteq3.0.2.0
opencart/opencarteq2.3.0.1
opencart/opencarteq2.3.0.2
opencart/opencarteq2.2.0.0
opencart/opencarteq2.3.0.0

Name	Operator	Version
opencart/opencart	eq	3.0.1.2
opencart/opencart	eq	3.0.0.0
opencart/opencart	eq	3.0.1.1
opencart/opencart	eq	3.0.0.2
opencart/opencart	eq	3.0.2.0
opencart/opencart	eq	2.3.0.1
opencart/opencart	eq	2.3.0.2
opencart/opencart	eq	2.2.0.0
opencart/opencart	eq	2.3.0.0