GitHub Advisoryadvisory · Packagist

GHSA-qv7g-j98v-8pp7 XSS vulnerability on email template preview page

MEDIUM Published 2022-01-06 Modified 2022-01-04 Official page ↗
Aliases
CVE-2021-41236
Ecosystem
Packagist
Packages
oro/platform
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Weaknesses
CWE-79
Reviewed
2022-01-04

Affected packages

• Packagist oro/platform: >= 3.1.0, < 3.1.21 → fixed in 3.1.21 • Packagist oro/platform: >= 4.1.0, < 4.1.14 → fixed in 4.1.14 • Packagist oro/platform: >= 4.2.0, < 4.2.8 → fixed in 4.2.8

Description

Summary Email template preview is vulnerable to XSS payload added to email template content. The attacker should have permission to create or edit an email template. For successful payload, execution attacked user should preview a vulnerable email template. Workarounds There are no workarounds that address this vulnerability.

Related

Alias · CVE (1)

  • CVE-2021-41236 OroPlatform is a PHP Business Application Platform. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References