{"id":"GHSA-jwqr-jcwp-445w","aliases":["CVE-2018-13067"],"title":"OpenCart Cross-Site Request Forgery (CSRF)","description":"`/upload/catalog/controller/account/password.php` in OpenCart through 3.0.2.0 has CSRF via the `index.php?route=account/password` URI to change a user's password.","severity":"high","score":8.8,"published":"2022-05-14T03:01:48.000Z","modified":"2024-04-23T17:43:53.353Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"opencart/opencart","ranges":[{"events":[{"introduced":"0"},{"last_affected":"3.0.2.0"}],"type":"ECOSYSTEM"}],"versions":["2.2.0.0","2.3.0.0","2.3.0.1","2.3.0.2","3.0.0.0","3.0.0.2","3.0.1.1","3.0.1.2","3.0.2.0"],"fixed":[]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2018-13067","https://github.com/opencart/opencart/issues/6912","https://github.com/opencart/opencart","https://whitehatck01.blogspot.com/2018/06/opencart-v3-0-3-0-user-changes-password.html"],"sources":[{"name":"OSV","id":"GHSA-jwqr-jcwp-445w","modified":"2024-04-23T17:43:53.353465Z","url":"https://osv.dev/vulnerability/GHSA-jwqr-jcwp-445w"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8}]}