CVE-2018-13067: CSRF
/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password.
Other sources
/upload/catalog/controller/account/password.php in OpenCart through 3.0.2.0 has CSRF via the index.php?route=account/password URI to change a user's password.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-13067?
The severity of CVE-2018-13067 is high with a severity value of 8.8.
How does CVE-2018-13067 affect OpenCart?
CVE-2018-13067 affects OpenCart versions up to and including 3.0.2.0.
What is the vulnerability in OpenCart identified by CVE-2018-13067?
The vulnerability in OpenCart identified by CVE-2018-13067 is a CSRF vulnerability in the /upload/catalog/controller/account/password.php file.
How can an attacker exploit CVE-2018-13067?
An attacker can exploit CVE-2018-13067 by sending a specially crafted request to the index.php?route=account/password URI to change a user's password without proper authorization.
Is there a fix available for CVE-2018-13067?
Yes, a fix is available for CVE-2018-13067. It is recommended to update to a version of OpenCart that is not affected by the vulnerability.