CVE-2022-26954: Medium severity Nopcommerce NopCommerce vulnerability
Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-26954?
CVE-2022-26954 is classified as a high-severity vulnerability due to its potential for facilitating phishing attacks.
How do I fix CVE-2022-26954?
To mitigate CVE-2022-26954, update your NopCommerce version to 4.50.2 or later, which addresses the vulnerability.
What versions of NopCommerce are affected by CVE-2022-26954?
CVE-2022-26954 affects NopCommerce versions from 4.10 through 4.50.1.
What types of attacks can be executed due to CVE-2022-26954?
CVE-2022-26954 can be exploited to conduct phishing attacks by redirecting users to malicious websites via manipulated URLs.
Which functions are involved in the CVE-2022-26954 vulnerability?
The open redirect vulnerabilities in CVE-2022-26954 are processed by the ChangePassword and SignInCustomerAsync functions.