PT-2022-28207 · Grapesjs · Grapesjs

Published 2022-07-15 · Updated 2022-07-15

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions GrapeJS versions prior to 0.19.5

Description The issue is due to insufficient class name validation in the GrapeJS library, allowing executable JS code to be added in the class name through the Selector Manager.

Recommendations For versions prior to 0.19.5, update the GrapeJS dependency to 0.19.5 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-6F85-3F8Q-QC94

Affected Products

Grapesjs

References · 4

• https://osv.dev/vulnerability/GHSA-6f85-3f8q-qc94 · Vendor Advisory
• https://github.com/artf/grapesjs/issues/4411 · Note
• https://github.com/oroinc/orocommerce/security/advisories/GHSA-6f85-3f8q-qc94 · Note
• https://github.com/oroinc/orocommerce · Note