PT-2020-12487 · Shopizer · Shopizer

Amine Boudraa · Published 2020-05-08 · Updated 2020-05-13 · CVE-2020-11006

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Shopizer versions prior to 2.11.0

Description A script can be injected in various forms and saved in the database, then executed when information is fetched from the backend.

Recommendations For versions prior to 2.11.0, update to version 2.11.0 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-11006

GHSA-8PC4-GVFW-634P

Affected Products

Shopizer

References · 5

• https://github.com/shopizer-ecommerce/shopizer/commit/929ca0839a80c6f4dad087e0259089908787ad2a · Patch
• https://osv.dev/vulnerability/CVE-2020-11006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11006 · Security Note
• https://github.com/shopizer-ecommerce/shopizer/security/advisories/GHSA-8pc4-gvfw-634p · Note
• https://t.me/cvenotify/3684 · Telegram Post