by Kastro
Paper/Archive/CVE-2021-47923

CVE-2021-47923

Opencart opencart — OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie

EPSS 0.4%public exploitCVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 36.6.366 × 207.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized access to user accounts.

Affected

ProductAffectedFixed inSource
opencart3.0.3.8–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/50555refopencart.comwriteupvulncheck.com/advisories/opencart-session-fixation-via-ocsessid-cookie