Are there specific rules for open cart 2.3?

It seems nope? Anyways from what I understood specifc rules simply apply virtual patching of past CVE?