GHSA-jwqr-jcwp-445w
OpenCart Cross-Site Request Forgery (CSRF)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | opencart/opencart | <= 3.0.2.0 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
`/upload/catalog/controller/account/password.php` in OpenCart through 3.0.2.0 has CSRF via the `index.php?route=account/password` URI to change a user's password.
References
External links from the advisory. They lead to third-party sites.