GitHub Advisoryadvisory · Packagist

GHSA-7pfc-cx3m-v22x SCart is vulnerable to cross-site scripting (XSS)

MEDIUM Published 2022-05-03 Modified 2022-05-23 Official page ↗
Aliases
CVE-2022-21149
Ecosystem
Packagist
Packages
s-cart/core, s-cart/s-cart
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-05-23

Affected packages

• Packagist s-cart/core: < 6.9 → fixed in 6.9 • Packagist s-cart/s-cart: < 6.9 → fixed in 6.9

Description

SCart e-commerce is a free open source for businesses, built on the Laravel framework. The package s-cart/s-cart before 6.9 and the package s-cart/core before 6.9 are vulnerable to cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL. An attacker can gain unauthorized access to that user's account through the stolen cookie.

Related

Alias · CVE (1)

  • CVE-2022-21149 The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References