GitHub Advisoryadvisory · Packagist

GHSA-rrgw-3hg3-9x8c XSS vulnerability in translations

MEDIUM Published 2022-01-12 Modified 2022-01-10 Official page ↗
Ecosystem
Packagist
Packages
oro/platform
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
Reviewed
2022-01-10

Affected packages

• Packagist oro/platform: >= 3.1.0, < 3.1.29 → fixed in 3.1.29 • Packagist oro/platform: >= 4.1.0, < 4.1.17 → fixed in 4.1.17 • Packagist oro/platform: >= 4.2.0, < 4.2.8 → fixed in 4.2.8

Description

Summary An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: • Translation management UI. • Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed. • Translations uploaded via Upload translation file on the All Languages grid Workarounds There are no workarounds that address this vulnerability.

References