GitHub Advisoryadvisory · Packagist

GHSA-87cv-57p8-j33x OpenCart Cross-site Scripting (XSS) in the Subject field of mail.

MEDIUM Published 2022-05-24 Modified 2024-04-23 Official page ↗
Aliases
CVE-2020-29470
Ecosystem
Packagist
Packages
opencart/opencart
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-23

Affected packages

• Packagist opencart/opencart: 3.0.3.6 (no fix yet)

Description

OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.

Related

Alias · CVE (1)

  • CVE-2020-29470 OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References