GHSA-3862-fmr3-4f3h

Broadleaf vulnerable to Cross-site Scripting

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-33725

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.broadleafcommerce:broadleaf	>= 5.0.0-GA, < 6.2.7-GA	6.2.7-GA

Details

As written in the advisory (Markdown source, shown as plain text).

Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.7-GA.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-33725 advisory
https://github.com/BroadleafCommerce/BroadleafCommerce package
https://github.com/Contrast-Security-OSS/Burptrast/tree/main/docs/CVE-2023-33725 web