CVE-2022-33077: High severity Nopcommerce NopCommerce vulnerability
Published Oct 19, 2022
·Updated
An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.
Affected Software
1 affected component
Nopcommerce NopCommerce<=4.50.2
Event History
Oct 19, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·02:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is CVE-2022-33077?
CVE-2022-33077 is an access control issue in nopcommerce v4.50.2 that allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.
2
How severe is CVE-2022-33077?
CVE-2022-33077 has a severity rating of 7.5 (High).
3
What software versions are affected by CVE-2022-33077?
CVE-2022-33077 affects nopcommerce v4.50.2.
4
How can an attacker exploit CVE-2022-33077?
An attacker can exploit CVE-2022-33077 by using parameter pollution to change the address of any customer.
5
Are there any references or resources available for CVE-2022-33077?
Yes, you can find more information about CVE-2022-33077 at http://nopcommerce.com and https://medium.com/@rohan_pagey/cve-2022-33077-idor-to-change-address-of-any-customer-via-parameter-pollution-in-nopcommerce-4-5-2fa4bc763cc6.