GHSA-4vf4-955g-vxp2

Source

https://github.com/advisories/GHSA-4vf4-955g-vxp2

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-4vf4-955g-vxp2/GHSA-4vf4-955g-vxp2.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-4vf4-955g-vxp2

Aliases

CVE-2022-31037

Published

2022-10-18T19:52:25Z

Modified

2023-11-08T04:09:23.576414Z

Severity

6.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N CVSS Calculator

Summary

OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration

Details

Impact

Shipping rule edit page is vulnerable to cross site scripting (XSS) payload added to UPS Surcharge field. The attacker should have permission to create or edit a shipping rule.

Database specific

{
    "nvd_published_at": "2022-10-18T10:15:00Z",
    "github_reviewed_at": "2022-10-18T19:52:25Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-79"
    ]
}

References

Affected packages

Packagist / oro/commerce

Package

Name: oro/commerce
Purl: pkg:composer/oro/commerce

Affected ranges

Type: ECOSYSTEM
Events: Introduced

4.1.0

Fixed

5.0.6

Affected versions

4.*

4.1.0

4.1.1-rc

4.1.1-rc2

4.1.1

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

4.1.7

4.1.8

4.1.9

4.1.10

4.1.11

4.1.12

4.1.13

4.2.0-alpha

4.2.0-alpha.1

4.2.0-alpha.2

4.2.0-alpha.3

4.2.0-beta

4.2.0-rc

4.2.0

4.2.1

4.2.2

4.2.3

4.2.4

4.2.5

4.2.6

4.2.7

4.2.8

4.2.9

4.2.10

5.*

5.0.0-alpha.1

5.0.0-alpha.2

5.0.0-beta.1

5.0.0-beta.2

5.0.0-rc

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.0.5