CVE-2021-47946

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47946
OpenCart 3.0.3.6 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can craft CSRF payloads that change victim email addresses and account information, then use password reset functionality to gain unauthorized access to compromised accounts.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.exploit-db.com/exploits/49407
https://www.opencart.com
https://www.opencart.com/index.php?route=cms/download
https://www.vulncheck.com/advisories/opencart-account-takeover-via-cross-site-request-forgery
Configurations

No configuration.

History

24 Jul 2026, 19:10

Type Values Removed Values Added
Summary
  • (es) OpenCart 3.0.36 contiene una vulnerabilidad de falsificación de petición en sitios cruzados en el endpoint /account/edit que permite a atacantes no autenticados modificar los detalles de la cuenta de la víctima engañando a los usuarios para que visiten páginas maliciosas. Los atacantes pueden crear cargas útiles de CSRF que cambian las direcciones de correo electrónico y la información de la cuenta de la víctima, y luego usar la funcionalidad de restablecimiento de contraseña para obtener acceso no autorizado a las cuentas comprometidas.

12 May 2026, 01:16

Type Values Removed Values Added
Summary (en) OpenCart 3.0.36 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can craft CSRF payloads that change victim email addresses and account information, then use password reset functionality to gain unauthorized access to compromised accounts. (en) OpenCart 3.0.3.6 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can craft CSRF payloads that change victim email addresses and account information, then use password reset functionality to gain unauthorized access to compromised accounts.

10 May 2026, 13:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-10 13:16

Updated : 2026-07-25 10:10

NVD link : CVE-2021-47946

Mitre link : CVE-2021-47946

CVE.ORG link : CVE-2021-47946

JSON object : View

Products Affected

No product.

CWE
CWE-352

Cross-Site Request Forgery (CSRF)