GitHub Advisoryadvisory · Packagist

GHSA-4vf4-955g-vxp2 OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration

MEDIUM Published 2022-10-18 Modified 2022-10-18 Official page ↗
Aliases
CVE-2022-31037
Ecosystem
Packagist
Packages
oro/commerce
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-10-18

Affected packages

• Packagist oro/commerce: >= 4.1.0, < 5.0.6 → fixed in 5.0.6

Description

Impact Shipping rule edit page is vulnerable to cross site scripting (XSS) payload added to UPS Surcharge field. The attacker should have permission to create or edit a shipping rule.

Related

Alias · CVE (1)

  • CVE-2022-31037 OroCommerce is an open-source Business to Business Commerce application. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References