shopware5/shopware · Security
Shopware Non-Persistent XSS in the Frontend
- GHSA ID
- GHSA-jqr7-5h7r-ch8p
- Severity
- medium
- Published
- Updated
- CVSS
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS v3
- 6.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
A non-persistent Cross-Site Scripting (XSS) vulnerability has been identified in the Shopware eCommerce platform within the frontend. This vulnerability may allow an attacker to inject and execute malicious scripts in the context of a victim's web browser.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- https://github.com/shopware5/shopware/commit/54461aa651566dc2701b873fe6bd94589604751b ↗
- https://community.shopware.com/_detail_2048.html ↗
- https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2018?category=shopware-5-en/security-updates ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/shopware/shopware/2018-01-22.yaml ↗
- https://github.com/advisories/GHSA-jqr7-5h7r-ch8p ↗