PT-2024-18930 · Opencart · Opencart

Calum Hutton · Published 2024-06-21 · Updated 2025-01-14 · CVE-2024-21517

Positive Technologies (AI Summary)

CVSS v3.1

4.2

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions opencart/opencart version 4.0.0.0

Description A reflected XSS issue was identified in the redirect parameter of the "customer account/login" route. An attacker can inject arbitrary HTML and Javascript into the page response. This issue is present in the account functionality and could be used to target and attack customers of the OpenCart shop.

Recommendations As a temporary workaround, consider restricting access to the vulnerable redirect parameter in the customer account/login route until a complete fix is available. Note: The current fix for this issue is incomplete, so it is essential to monitor for updates and apply a complete fix as soon as it becomes available. At the moment, there is no information about a newer version that contains a complete fix for this vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-OPENCART-2024-21517

CVE-2024-21517

GHSA-QC3Q-8RR8-8P5V

Affected Products

Opencart

References · 10

• 🔥 https://security.snyk.io/vuln/SNYK-PHP-OPENCARTOPENCART-7266577 · Exploit
• https://github.com/opencart/opencart/commit/0fd1ee4b6c94366bf3e5d3831a8336f3275d1860 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-21517 · Security Note
• https://osv.dev/vulnerability/BIT-opencart-2024-21517 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21517 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qc3q-8rr8-8p5v · Vendor Advisory
• https://github.com/opencart/opencart · Note
• https://twitter.com/CVEnew/status/1804382598778454261 · Twitter Post
• https://t.me/cvenotify/84106 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1804725463505392066 · Twitter Post