CVE-2021-47953
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick authenticated users into submitting hidden forms with new password values in the 'password' and 'confirm' parameters to hijack accounts.
Risk Assessment
An attacker can hijack a user account by changing their password without the victim's knowledge, potentially leading to data theft or further attacks.
Recommendation
Update OpenCart to version 3.0.3.8 or later, which includes a CSRF fix. Implement CSRF protections (e.g., tokens) in all sensitive forms.
Original NVD description (English source)
OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick authenticated users into submitting hidden forms with new password values in the 'password' and 'confirm' parameters to hijack accounts.