CVE-2022-33077 in nopCommerce
Summary
by MITRE • 10/19/2022
An access control issue in nopcommerce v4.50.2 allows attackers to arbitrarily modify any customer's address via the addressedit endpoint.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/07/2026
The vulnerability identified as CVE-2022-33077 represents a critical access control flaw within the nopcommerce e-commerce platform version 4.50.2. This issue stems from insufficient authorization checks within the addressedit endpoint, which permits unauthorized users to manipulate customer address information regardless of their actual permissions or identity. The flaw exists in the platform's user authentication and authorization framework, specifically failing to validate whether the requesting user possesses legitimate rights to modify the target customer's address details.
The technical implementation of this vulnerability allows an attacker to exploit the lack of proper session validation and user context verification when processing address modification requests. The addressedit endpoint does not adequately verify that the authenticated user is either the owner of the address being modified or has elevated privileges to perform such operations on behalf of other users. This weakness enables arbitrary address changes through direct API manipulation or web interface exploitation, bypassing normal access control mechanisms that should restrict modifications to authorized personnel or account owners.
From an operational perspective, this vulnerability poses significant risks to both customer data integrity and business security. Attackers can potentially modify customer shipping addresses to redirect orders, change billing information for fraudulent purposes, or manipulate address data for identity theft attempts. The impact extends beyond simple data modification as it can facilitate more complex attacks including account takeover scenarios, payment fraud, and disruption of legitimate business operations. The vulnerability affects all customers within the platform who have addresses stored in the database, creating a widespread potential impact that scales with the size of the customer base.
The security implications of CVE-2022-33077 align with CWE-285, which addresses improper authorization issues in software systems, and maps to ATT&CK technique T1078 for valid accounts usage and T1566 for credential harvesting. Organizations utilizing nopcommerce v4.50.2 should immediately implement mitigations including thorough input validation, enhanced session management, and proper access control enforcement. The recommended remediation involves strengthening the addressedit endpoint to verify user context, implementing role-based access controls, and conducting comprehensive security testing of all user-facing API endpoints. Additionally, organizations should review their authentication mechanisms and consider implementing additional security layers such as rate limiting and monitoring for suspicious address modification activities. This vulnerability demonstrates the critical importance of proper authorization controls in web applications and highlights the necessity of comprehensive security testing throughout the software development lifecycle to prevent such access control bypasses that can compromise entire user databases and customer information systems.