GHSA-87cv-57p8-j33x

Source

https://github.com/advisories/GHSA-87cv-57p8-j33x

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-87cv-57p8-j33x/GHSA-87cv-57p8-j33x.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-87cv-57p8-j33x

Aliases

CVE-2020-29470

Published

2022-05-24T17:37:27Z

Modified

2024-04-23T17:28:55.952392Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

OpenCart Cross-site Scripting (XSS) in the Subject field of mail.

Details

OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail. This vulnerability can allow an attacker to inject the XSS payload in the Subject field of the mail and each time any user will open that mail of the website, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.

Database specific

{
    "nvd_published_at": "2020-12-29T17:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-23T17:06:49Z"
}

GHSA-87cv-57p8-j33x

Affected packages

Packagist / opencart/opencart

Package

Affected ranges

Affected versions

3.*