CVE-2024-21517: Cross-Site Scripting in OpenCart
Summary
CVE-2024-21517: Cross site scripting in opencart. Affects opencart/opencart versions >= 4.0.0.0. No fix is published. How to fix ↓
Also tracked for
- opencart · Bitnami
The same CVE-2024-21517 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenCart is an open-source e-commerce platform that allows users to create and manage online stores. It provides various features for managing products, orders, customers, and more. The package 'opencart/opencart' is a popular version of OpenCart. However, it has been found to be vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability exists in versions of the 'opencart/opencart' package starting from 4.0.0.0. It is a reflected XSS issue that affects the redirect parameter of the customer account/login route. An attacker can exploit this vulnerability by injecting arbitrary HTML and JavaScript code into the page response. Since this vulnerability is present in the account functionality, it can be used to target and attack customers of OpenCart shops. It is important to note that the fix for this vulnerability is incomplete.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is advised to follow the recommended fix and update the 'opencart/opencart' package to a secure version as soon as it becomes available.
Conclusion
The 'opencart/opencart' package is vulnerable to a reflected XSS issue in the redirect parameter of the customer account/login route. This can be exploited by attackers to inject malicious code and potentially target customers of OpenCart shops. It is crucial for users to update to a secure version of the package once a complete fix is released.
See every vulnerability recorded for opencart/opencart →
FAQ
OpenCart is an open-source e-commerce platform used for creating and managing online stores.
The 'opencart/opencart' package is a version of OpenCart that provides various features for managing online stores.
A reflected XSS issue is a type of vulnerability where an attacker can inject malicious code that is then executed by the victim's browser.
This vulnerability can be exploited by an attacker injecting arbitrary HTML and JavaScript code into the page response of the customer account/login route.
No, the fix for this vulnerability is currently incomplete. Users should update to a secure version once it becomes available.
References
Related vulnerabilities
Recent vulnerabilities recorded for opencart/opencart.
