PT-2024-40404 · Thelia · Thelia

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Thelia versions 2.1.0 through 2.1.1

Description The BackOffice of Thelia has a cross-site scripting issue in the error.html template.

Recommendations For versions 2.1.0 and 2.1.1, update to version 2.1.2 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

GHSA-PP7V-WXX9-HM6R

Affected Products

Thelia

References · 6

• https://osv.dev/vulnerability/GHSA-pp7v-wxx9-hm6r · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/thelia/backoffice-default-template/2015-02-24-1.yaml · Note
• https://github.com/thelia-templates/back · Note
• https://github.com/thelia-templates/back/commit/592612899057addc2613ccddf172024588277d2d · Note
• https://web.archive.org/web/20160406004324/http://thelia.net/version-2-1-2-with-security-fix · Note
• https://thelia.net/version-2-1-2-with-security-fix · Note