VULNERABILITY INTELLIGENCE

CVE-2021-47923

CVSS score9.3 CRITICAL
EPSS probability0.42%
CISA KEVNot currently listed
Published2026-05-10
Last modified2026-10-06
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized access to user accounts.

Weakness classification

  • CWE-290: Authentication Bypass by Spoofing

Primary references