Esta página ainda não foi traduzida para o seu idioma. Exibindo conteúdo em inglês enquanto trabalhamos nisso.
💡 Keep dependencies up to date — most exploits target known, patchable vulnerabilities.
CVE-2026-45055: SSRF in CubeCart v6 Ecommerce Software
Plataforma
php
Componente
cubecart
Corrigido em
6.7.2
CVE-2026-45055 is a Server-Side Request Forgery (SSRF) vulnerability affecting CubeCart v6 versions 6.6.0 through 6.7.1. An attacker can exploit this flaw to craft malicious password reset links, potentially leading to account takeover. The vulnerability stems from the improper handling of the Host header during bootstrap, which is then embedded directly into transactional email links. A fix is available in CubeCart version 6.7.2.
Impacto e Cenários de Ataquetraduzindo…
The primary impact of this SSRF vulnerability lies in the ability of an unauthenticated attacker to manipulate password reset links. By crafting a malicious Host header, an attacker can redirect the password reset link to an attacker-controlled domain. When a user clicks this link, they are prompted to enter a new password on the attacker's site, effectively granting the attacker control of the user's account. This could lead to data theft, fraudulent transactions, or further compromise of the ecommerce platform. The vulnerability's impact is amplified by the fact that it targets a critical function – password recovery – which is often used by legitimate users, increasing the likelihood of exploitation. This attack pattern shares similarities with other SSRF-based phishing campaigns, where attackers leverage trusted domains to trick users into divulging credentials.
Contexto de Exploraçãotraduzindo…
CVE-2026-45055 was published on May 13, 2026. Currently, there are no public exploit code or active campaigns targeting this vulnerability. The CVSS score of 8.1 (HIGH) indicates a significant risk, and it is likely to be added to KEV (Known Exploited Vulnerabilities) lists if exploitation becomes widespread. Monitor security advisories and threat intelligence feeds for updates.
Inteligência de Ameaças
Status do Exploit
CISA SSVC
Vetor CVSS
O que significam essas métricas?
- Attack Vector
- Rede — explorável remotamente pela internet. Sem acesso físico ou local necessário.
- Attack Complexity
- Baixa — sem condições especiais. O atacante pode explorar de forma confiável.
- Privileges Required
- Nenhum — sem autenticação necessária para explorar.
- User Interaction
- Necessária — a vítima deve abrir um arquivo, clicar em um link ou visitar uma página.
- Scope
- Inalterado — impacto limitado ao componente vulnerável.
- Confidentiality
- Alto — perda total de confidencialidade. O atacante pode ler todos os dados.
- Integrity
- Alto — o atacante pode escrever, modificar ou excluir qualquer dado.
- Availability
- Nenhum — sem impacto na disponibilidade.
Software Afetado
Classificação de Fraqueza (CWE)
Linha do tempo
- Reservado
- Publicada
- Modificada
Mitigação e Soluções Alternativastraduzindo…
The primary mitigation for CVE-2026-45055 is to immediately upgrade CubeCart to version 6.7.2 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests with suspicious Host headers. Specifically, block requests where the Host header contains unexpected or malicious domains. Additionally, review CubeCart's configuration to ensure that any custom settings related to email sending are secure and do not introduce similar vulnerabilities. After upgrading, confirm the fix by attempting to trigger a password reset and verifying that the generated link points to the correct CubeCart domain.
Como corrigirtraduzindo…
Actualice CubeCart a la versión 6.7.2 o superior para mitigar la vulnerabilidad de envenenamiento de enlaces de restablecimiento de contraseña. La versión corregida valida el Host request header, previniendo la inyección de dominios maliciosos en los enlaces de restablecimiento de contraseña.
Perguntas frequentestraduzindo…
What is CVE-2026-45055 — SSRF in CubeCart v6?
CVE-2026-45055 is a Server-Side Request Forgery vulnerability in CubeCart v6 (versions 6.6.0–6.7.1) that allows attackers to manipulate password reset links, potentially leading to account takeover.
Am I affected by CVE-2026-45055 in CubeCart v6?
If you are running CubeCart v6 versions 6.6.0 through 6.7.1, you are vulnerable to this SSRF attack. Upgrade to version 6.7.2 or later to mitigate the risk.
How do I fix CVE-2026-45055 in CubeCart v6?
The recommended fix is to upgrade CubeCart to version 6.7.2 or later. As a temporary workaround, implement a WAF rule to block requests with suspicious Host headers.
Is CVE-2026-45055 being actively exploited?
As of the publication date, there are no reports of active exploitation. However, the vulnerability's severity warrants immediate attention and mitigation.
Where can I find the official CubeCart advisory for CVE-2026-45055?
Refer to the official CubeCart security advisory on their website or GitHub repository for detailed information and updates regarding CVE-2026-45055.
Seu projeto está afetado?
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.
Experimente agora — sem conta
Faça upload de qualquer manifesto (composer.lock, package-lock.json, lista de plugins WordPress…) ou cole sua lista de componentes. Receba um relatório de vulnerabilidades instantaneamente. Fazer upload de um arquivo é só o começo: com uma conta, você obtém monitoramento contínuo, alertas por Slack/email, relatórios multiprojeto e white-label.
Arraste e solte seu arquivo de dependências
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...