Read the docs
TI-2021-22536 Aliases CVE-2021-47923GHSA-5hhh-fq62-xfww

OpenCart 3.0.3.8 Session Fixation via OCSESSID Cookie

Priority HIGH 81CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-290.

Summary

OpenCart 3.0.3.8 contains a session fixation vulnerability that allows attackers to hijack user sessions by injecting arbitrary values into the OCSESSID cookie. Attackers can set malicious OCSESSID cookie values that the server accepts and maintains, enabling session takeover and unauthorized access to user accounts.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00423 36th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenCartopencart3.0.3.8—No fix listedCNA
  • opencart VendorOpenCart Affected 3.0.3.8 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:*——OpenCart
  • cpe:2.3:a:opencart:opencart:*:*:*:*:*:*:*:* Versions — — ·OpenCart

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-47923
  2. 2026-10-03 Alias added: GHSA-5hhh-fq62-xfww

References

Exploit 1

Other 1

  • TI-2023-21572 OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page… CVSS 3.1CRITICAL 9.8
  • TI-2024-38428 OpenCart Core 4.0.2.3 SQL Injection via search Parameter CVSS 4.0HIGH 8.8
  • TI-2023-25651 An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users… CVSS 3.1HIGH 8.8
  • TI-2023-02171 Improper input validation in Opencart CVSS 3.1HIGH 8.8
  • TI-2021-22559 OpenCart 3.0.3.6 Account Takeover via Cross Site Request Forgery CVSS 4.0MEDIUM 6.9
  • TI-2024-14270 SQL injection in opencart/opencart CVSS 3.1HIGH 8.1
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences