Security readout for executives and security teams
Plain-English summary
CVE-2022-27461 is an open redirect issue reported in nopCommerce 4.50.1. A victim can be lured through a crafted link during authentication and redirected to an attacker-chosen site. This mainly supports phishing and trust abuse, not direct server compromise based on the supplied evidence.
Executive priority
Treat this as a phishing-enablement risk. It is less urgent than remote code execution, but should be addressed on customer-facing commerce sites because it can abuse brand trust during login.
Technical view
The public CVE description states that nopCommerce 4.50.1 can be induced to redirect an authenticating user through a crafted link. The source bundle provides no CVSS score, CWE mapping, patch version, or structured affected CPE data, so technical scope remains limited.
Likely exposure
Exposure is likely limited to public nopCommerce 4.50.1 deployments where authentication or return-url flows are reachable by users.
Exploitation context
The bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation depends on social engineering a user to click a crafted authentication link.
Researcher notes
Evidence is sparse: the CVE record names nopCommerce 4.50.1 and an open redirect scenario, but lacks CVSS, CWE, patch details, and structured affected product metadata. Do not assume broader version impact without vendor confirmation.
Mitigation direction
- Check nopCommerce vendor guidance for fixed versions or official configuration advice.
- Prioritize upgrade review for any deployment confirmed on nopCommerce 4.50.1.
- Restrict authentication redirects to local or explicitly allowlisted destinations.
- Review custom login or return-url handling for unsafe external redirects.
- Monitor authentication logs for suspicious redirect destinations.
Validation and detection
- Inventory internet-facing and internal nopCommerce instances and confirm exact versions.
- Review authentication flows for redirect parameters accepting external destinations.
- Verify redirects after login reject untrusted domains.
- Check whether vendor advisories identify a fixed release for this issue.
- Document any exposed affected instance and remediation owner.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-27461 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://tf1t.gitbook.io/mycve/nopcommerce/open-redirect-on-nopcommerce-4.50.1CVE reference, mitre
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.