PT-2024-36732 · Optimizely · Optimizely Configured Commerce

Published 2024-12-18 · Updated 2024-12-18 · CVE-2024-56175

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Optimizely Configured Commerce versions prior to 5.2.2408

Description The issue allows malicious payloads to be stored and executed in users' browsers under specific conditions due to a client-side template injection in list item names, leading to a cross-site scripting (XSS) attack.

Recommendations For versions prior to 5.2.2408, update to version 5.2.2408 or later to resolve the issue. As a temporary workaround, consider restricting the ability to inject templates in list item names to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-56175

Affected Products

Optimizely Configured Commerce

References · 7

• https://support.optimizely.com/hc/en-us/articles/32344323720973-Configured-Commerce-Security-Advisory-COM-2024-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-56175 · Security Note
• https://osv.dev/vulnerability/CVE-2024-56175 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1869309445383061532 · Twitter Post
• https://twitter.com/CVEnew/status/1869258915948769640 · Twitter Post
• https://t.me/cvedetector/13161 · Telegram Post
• https://t.me/cvenotify/104660 · Telegram Post