Threats affecting pkg:github/nopCommerce

nopCommerce versions before 5.00.0 have an authorization bypass vulnerability in certain admin product handlers. Authenticated vendors can exploit this flaw by submitting another vendor's product ID to inject their products into the victim's related, cross-sell, and grouped product listings. This issue is fixed in version 5.00.0.

nopCommerce v4.70 and prior, and version 4.80.3, does not invalidate session cookies after logout or session termination, allowing an attacker who has a a valid session cookie access to privileged endpoints (such as /admin) even after the legitimate user has logged out, enabling session hijacking. Any version above 4.70 that is not 4.80.3 fixes the vulnerability.

Nopcommerce 4.70.1 is vulnerable to Cross Site Scripting (XSS) via the combined "AddProductReview.Title" and "AddProductReview.ReviewText" parameter(s) (Reviews) when creating a new review.