Deze pagina is nog niet vertaald naar uw taal. We werken eraan — de inhoud wordt voorlopig in het Engels weergegeven.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-45055: SSRF in CubeCart v6 Ecommerce Software
Platform
php
Component
cubecart
Opgelost in
6.7.2
CVE-2026-45055 is a Server-Side Request Forgery (SSRF) vulnerability affecting CubeCart v6 versions 6.6.0 through 6.7.1. An attacker can exploit this flaw to craft malicious password reset links, potentially leading to account takeover. The vulnerability stems from the improper handling of the Host header during bootstrap, which is then embedded directly into transactional email links. A fix is available in CubeCart version 6.7.2.
Impact en Aanvalsscenarioswordt vertaald…
The primary impact of this SSRF vulnerability lies in the ability of an unauthenticated attacker to manipulate password reset links. By crafting a malicious Host header, an attacker can redirect the password reset link to an attacker-controlled domain. When a user clicks this link, they are prompted to enter a new password on the attacker's site, effectively granting the attacker control of the user's account. This could lead to data theft, fraudulent transactions, or further compromise of the ecommerce platform. The vulnerability's impact is amplified by the fact that it targets a critical function – password recovery – which is often used by legitimate users, increasing the likelihood of exploitation. This attack pattern shares similarities with other SSRF-based phishing campaigns, where attackers leverage trusted domains to trick users into divulging credentials.
Uitbuitingscontextwordt vertaald…
CVE-2026-45055 was published on May 13, 2026. Currently, there are no public exploit code or active campaigns targeting this vulnerability. The CVSS score of 8.1 (HIGH) indicates a significant risk, and it is likely to be added to KEV (Known Exploited Vulnerabilities) lists if exploitation becomes widespread. Monitor security advisories and threat intelligence feeds for updates.
Dreigingsinformatie
Exploit Status
CISA SSVC
CVSS-vector
Wat betekenen deze metrics?
- Attack Vector
- Netwerk — op afstand uitbuitbaar via internet. Geen fysieke of lokale toegang vereist.
- Attack Complexity
- Laag — geen speciale voorwaarden vereist. Betrouwbaar uitbuitbaar.
- Privileges Required
- Geen — geen authenticatie vereist om te exploiteren.
- User Interaction
- Vereist — slachtoffer moet een bestand openen, op een link klikken of een pagina bezoeken.
- Scope
- Ongewijzigd — impact beperkt tot het kwetsbare component.
- Confidentiality
- Hoog — volledig verlies van vertrouwelijkheid. Aanvaller kan alle gegevens lezen.
- Integrity
- Hoog — aanvaller kan alle gegevens schrijven, aanpassen of verwijderen.
- Availability
- Geen — geen beschikbaarheidsimpact.
Getroffen Software
Zwakheidsclassificatie (CWE)
Tijdlijn
- Gereserveerd
- Gepubliceerd
- Gewijzigd
Mitigatie en Workaroundswordt vertaald…
The primary mitigation for CVE-2026-45055 is to immediately upgrade CubeCart to version 6.7.2 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests with suspicious Host headers. Specifically, block requests where the Host header contains unexpected or malicious domains. Additionally, review CubeCart's configuration to ensure that any custom settings related to email sending are secure and do not introduce similar vulnerabilities. After upgrading, confirm the fix by attempting to trigger a password reset and verifying that the generated link points to the correct CubeCart domain.
Hoe te verhelpenwordt vertaald…
Actualice CubeCart a la versión 6.7.2 o superior para mitigar la vulnerabilidad de envenenamiento de enlaces de restablecimiento de contraseña. La versión corregida valida el Host request header, previniendo la inyección de dominios maliciosos en los enlaces de restablecimiento de contraseña.
Veelgestelde vragenwordt vertaald…
What is CVE-2026-45055 — SSRF in CubeCart v6?
CVE-2026-45055 is a Server-Side Request Forgery vulnerability in CubeCart v6 (versions 6.6.0–6.7.1) that allows attackers to manipulate password reset links, potentially leading to account takeover.
Am I affected by CVE-2026-45055 in CubeCart v6?
If you are running CubeCart v6 versions 6.6.0 through 6.7.1, you are vulnerable to this SSRF attack. Upgrade to version 6.7.2 or later to mitigate the risk.
How do I fix CVE-2026-45055 in CubeCart v6?
The recommended fix is to upgrade CubeCart to version 6.7.2 or later. As a temporary workaround, implement a WAF rule to block requests with suspicious Host headers.
Is CVE-2026-45055 being actively exploited?
As of the publication date, there are no reports of active exploitation. However, the vulnerability's severity warrants immediate attention and mitigation.
Where can I find the official CubeCart advisory for CVE-2026-45055?
Refer to the official CubeCart security advisory on their website or GitHub repository for detailed information and updates regarding CVE-2026-45055.
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Probeer het nu — geen account
Upload een manifest (composer.lock, package-lock.json, WordPress pluginlijst…) of plak uw componentenlijst. U ontvangt direct een kwetsbaarheidsrapport. Een bestand uploaden is slechts het begin: met een account krijgt u continue monitoring, Slack/e-mail alerts, multi-project en white-label rapporten.
Sleep uw afhankelijkheidsbestand hierheen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...