PT-2022-20477 · Unknown · Orocommerce

Rgrebenchuk · Published 2022-10-18 · Updated 2022-10-20 · CVE-2022-31037

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OroCommerce versions 4.1.0 through 4.1.17 OroCommerce versions 4.2.0 through 4.2.11 OroCommerce versions 5.0.0 through 5.0.3

Description The issue concerns Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. An attacker needs permission to create or edit a shipping rule to exploit this.

Recommendations For versions 4.1.0 through 4.1.17, update to a version newer than 5.0.3, specifically to version 5.0.6 or later. For versions 4.2.0 through 4.2.11, update to a version newer than 5.0.3, specifically to version 5.0.6 or later. For versions 5.0.0 through 5.0.3, update to version 5.0.6 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31037

GHSA-4VF4-955G-VXP2

Affected Products

Orocommerce

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31037.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-31037 · Security Note
• https://osv.dev/vulnerability/GHSA-4vf4-955g-vxp2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-31037 · Vendor Advisory
• https://github.com/oroinc/orocommerce · Note
• https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2 · Note