CVE-2021-47953: OpenCart 3.0.3.7 Cross-Site Request Forgery via account/password
OpenCart 3.0.3.7 contains a cross-site request forgery vulnerability that allows attackers to change user passwords by sending crafted requests to the account/password endpoint. Attackers can trick authenticated users into submitting hidden forms with new password values in the 'password' and 'confirm' parameters to hijack accounts.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-47953?
CVE-2021-47953 is classified as a medium severity cross-site request forgery vulnerability.
How do I fix CVE-2021-47953?
To fix CVE-2021-47953, update OpenCart to a version later than 3.0.3.7 that addresses this vulnerability.
What impact does CVE-2021-47953 have on my OpenCart site?
CVE-2021-47953 allows attackers to change user passwords by tricking authenticated users into submitting crafted requests.
Who is affected by CVE-2021-47953?
CVE-2021-47953 affects users of OpenCart version 3.0.3.7.
How can attackers exploit CVE-2021-47953?
Attackers can exploit CVE-2021-47953 by deceiving users into clicking on malicious links that send forged requests to the account/password endpoint.