GHSA-2jc6-3fhj-8q84
OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | oro/commerce | >= 4.1.0, <= 4.1.13 | no fix listed |
| Packagist | oro/commerce | >= 4.2.0, <= 4.2.10 | no fix listed |
| Packagist | oro/commerce | >= 5.0.0, < 5.0.11 | 5.0.11 |
| Packagist | oro/commerce | >= 5.1.0, < 5.1.1 | 5.1.1 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
The JS payload added to the product name may be executed at the storefront when adding a note to the shopping list line item containing a vulnerable product.
An attacker should be able to edit a product in the admin area and force a user to add this product to Shopping List and click add a note for it.
References
External links from the advisory. They lead to third-party sites.