CVE-2022-28448: XSS

Published Apr 26, 2022

Updated

nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). An attacker (role customer) can inject javascript code to First name or Last name at Customer Info.

Affected Software

1 affected component

Nopcommerce NopCommerce=4.50.1

Event History

Apr 26, 2022

CVE Published

via MITRE·07:58 PM

Data Sourced

via MITRE·07:58 PM

Description

Frequently Asked Questions

What is the severity of CVE-2022-28448?

CVE-2022-28448 is classified as a medium-severity vulnerability due to its potential for Cross Site Scripting (XSS) attacks.

How do I fix CVE-2022-28448?

To fix CVE-2022-28448, update nopCommerce to the latest version that addresses this vulnerability.

What type of vulnerability is CVE-2022-28448?

CVE-2022-28448 is a Cross Site Scripting (XSS) vulnerability that allows an attacker to inject malicious JavaScript code.

Who is affected by CVE-2022-28448?

CVE-2022-28448 affects nopCommerce version 4.50.1 users, allowing attackers with customer roles to exploit the vulnerability.

What can an attacker do with CVE-2022-28448?

An attacker exploiting CVE-2022-28448 can inject JavaScript code into the customer information fields, leading to potential data theft or session hijacking.