CVE-2022-26954

Name of the Vulnerable Software and Affected Versions NopCommerce versions 4.10 through 4.50.1

Description The issue allows remote attackers to conduct phishing attacks by redirecting users to attacker-controlled web sites via the returnUrl parameter. This parameter is processed by several functions, including the ChangePassword function, SignInCustomerAsync function, SuccessfulAuthentication method, or the NopRedirectResultExecutor class.

Recommendations For NopCommerce versions 4.10 through 4.50.1, consider disabling the returnUrl parameter in the affected functions until a patch is available. Restrict access to the ChangePassword function, SignInCustomerAsync function, SuccessfulAuthentication method, and the NopRedirectResultExecutor class to minimize the risk of exploitation. Avoid using the returnUrl parameter in the affected API endpoints until the issue is resolved.