GHSA-2jc6-3fhj-8q84MediumCVSS 4.8

OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item

Published
October 10, 2023
Last Modified
November 8, 2023

🔗 CVE IDs covered (1)

CVE-2022-35950 →

📋 Description

Impact

The JS payload added to the product name may be executed at the storefront when adding a note to the shopping list line item containing a vulnerable product. An attacker should be able to edit a product in the admin area and force a user to add this product to Shopping List and click add a note for it.

🎯 Affected products4

  • composer/oro/commerce:>= 4.1.0, <= 4.1.13
  • composer/oro/commerce:>= 4.2.0, <= 4.2.10
  • composer/oro/commerce:>= 5.0.0, < 5.0.11
  • composer/oro/commerce:>= 5.1.0, < 5.1.1

🔗 References (3)