Log in Start free

Vulnerability · Published Jan 4, 2022 · Assigned by GitHub_M

CVE-2021-41236XSS vulnerability in oro/platform

Medium 6.9

In plain English

A medium-severity cross-site scripting in platform from oroinc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.9Medium
Exploit odds (30 days)0.7%top 46.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistoro/platform3.1.21GHSA-qv7g-j98v-8pp7
Packagistoro/platform4.1.14GHSA-qv7g-j98v-8pp7
Packagistoro/platform4.2.8GHSA-qv7g-j98v-8pp7

Affected products (as reported)

VendorProductVersions
oroinc platform >= 3.1.0, < 3.1.21>= 4.1.0, < 4.1.14>= 4.2.0, < 4.2.8

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

References