PT-2024-27454 · Unknown · Woocommerce+1

Tomalec · Published 2024-06-12 · Updated 2024-07-23 · CVE-2024-37297

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WooCommerce versions 8.8 through 8.8.4 WooCommerce versions 8.9 through 8.9.2

Description A cross-site scripting vulnerability in WooCommerce allows a bad actor to manipulate a link to include malicious HTML and JavaScript content. The injected JavaScript could hijack content and data stored in the browser, including the session. The URL content is read through the Sourcebuster.js library and then inserted without proper sanitization to the classic checkout and registration forms.

Recommendations For versions 8.8 through 8.8.4, update to version 8.8.5 or later. For versions 8.9 through 8.9.2, update to version 8.9.3 or later. As a temporary workaround, consider disabling the Order Attribution feature to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2024-37297

GHSA-CV23-Q6GH-XFRF

Affected Products

Sourcebuster.Js

Woocommerce

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37297.json · Exploit
• https://github.com/woocommerce/woocommerce/commit/0e9888305d0cb9557e58f558526ab11cb3bcc4b4 · Patch
• https://github.com/woocommerce/woocommerce/security/advisories/GHSA-cv23-q6gh-xfrf · Patch
• https://github.com/woocommerce/woocommerce/commit/915e32a42762916b745a7e663c8b69a698da8b67 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-37297 · Security Note
• https://osv.dev/vulnerability/GHSA-cv23-q6gh-xfrf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-37297 · Vendor Advisory
• https://github.com/woocommerce/woocommerce · Note
• https://developer.woocommerce.com/2024/06/10/developer-advisory-xss-vulnerability-8-8-0 · Note