GitHub Advisoryadvisory · Packagist
GHSA-jqr7-5h7r-ch8p Shopware Non-Persistent XSS in the Frontend
MEDIUM
Official page ↗
- Ecosystem
- Packagist
- Packages
- shopware/shopware
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
- Reviewed
- 2024-05-21
Affected packages
• Packagist shopware/shopware: >= 5.2.0, < 5.3.7 → fixed in 5.3.7
Description
A non-persistent Cross-Site Scripting (XSS) vulnerability has been identified in the Shopware eCommerce platform within the frontend. This vulnerability may allow an attacker to inject and execute malicious scripts in the context of a victim's web browser.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/shopware5/shopware/commit/54461aa651566dc2701b873fe6bd94589604751b web
- https://community.shopware.com/_detail_2048.html web
- https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2018?category=shopware-5-en/security-updates web
- https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/2018-01-22.yaml web
- https://github.com/shopware5/shopware package