PT-2024-36731 · Optimizely · Optimizely Configured Commerce

Published 2024-12-18 · Updated 2024-12-23 · CVE-2024-56174

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Optimizely Configured Commerce versions prior to 5.2.2408

Description The issue allows malicious payloads to be stored and subsequently executed in users' browsers under specific conditions. This is due to a client-side template injection in search history, leading to a cross-site scripting (XSS) vulnerability.

Recommendations For versions prior to 5.2.2408, update to version 5.2.2408 or later to resolve the issue. As a temporary workaround, consider restricting access to the search history feature to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56174

Affected Products

Optimizely Configured Commerce

References · 8

• https://osv.dev/vulnerability/CVE-2024-56174 · Vendor Advisory
• https://support.optimizely.com/hc/en-us/articles/32344323720973-Configured-Commerce-Security-Advisory-COM-2024-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56174 · Security Note
• https://twitter.com/VulmonFeeds/status/1869317125266874841 · Twitter Post
• https://twitter.com/cracbot/status/1871073310672572622 · Twitter Post
• https://t.me/cvenotify/104659 · Telegram Post
• https://t.me/cvedetector/13166 · Telegram Post
• https://twitter.com/CVEnew/status/1869258914799472750 · Twitter Post