CVE-2022-26954
EUVD-2022-3149820.10.2022, 11:15
Multiple open redirect vulnerabilities in NopCommerce 4.10 through 4.50.1 allow remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter, processed by the (1) ChangePassword function, (2) SignInCustomerAsync function, (3) SuccessfulAuthentication method, or (4) NopRedirectResultExecutor class.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| nopcommerce | nopcommerce | 4.10 ≤ 𝑥 < 4.50.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration