PT-2022-28278 · Packagist · Oroplatform

Published 2022-01-12 · Updated 2022-01-12

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned, so the information cannot be provided.

Description The issue allows an attacker with admin privileges and access to Translations management functionality to add a JS payload to translation values. This can be done through the Translation management UI, or by downloading translations via the Crowdin service that contain JS strings used for XSS attacks. The attacker can also upload poisoned translations via the Upload translation file on the All Languages grid. For a successful attack, the poisoned translation must be enabled, downloaded, and installed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-RRGW-3HG3-9X8C

Affected Products

Oroplatform

References · 2

• https://osv.dev/vulnerability/GHSA-rrgw-3hg3-9x8c · Vendor Advisory
• ❌ https://github.com/oroinc/platform-er/security/advisories/GHSA-rrgw-3hg3-9x8c · Note, Deleted