CVE-2022-28449: XSS
Published Apr 26, 2022
·Updated
nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). At Apply for vendor account feature, an attacker can upload an arbitrary file to the system.
Affected Software
1 affected component
Nopcommerce NopCommerce=4.50.1
Event History
Apr 26, 2022
CVE Published
via MITRE·08:02 PM
Data Sourced
via MITRE·08:02 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2022-28449?
CVE-2022-28449 is classified as a medium severity Cross Site Scripting (XSS) vulnerability.
2
How do I fix CVE-2022-28449?
To fix CVE-2022-28449, update nopCommerce to version 4.50.2 or later where the vulnerability is addressed.
3
What impact does CVE-2022-28449 have on my system?
CVE-2022-28449 allows attackers to execute arbitrary scripts in the context of user sessions, potentially leading to data theft or session hijacking.
4
Is CVE-2022-28449 exploitable without user interaction?
CVE-2022-28449 can be exploited with minimal user interaction, making it a serious risk for affected systems.
5
Which versions of nopCommerce are affected by CVE-2022-28449?
CVE-2022-28449 specifically affects nopCommerce version 4.50.1.