// For flags

CVE-2021-41236

XSS vulnerability in oro/platform

Severity Score

4.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible.

OroPlatform es una plataforma de aplicaciones empresariales en PHP. En las versiones afectadas, la vista previa de la plantilla de correo electrónico es vulnerable a una carga útil de tipo XSS añadida al contenido de la plantilla de correo electrónico. Un atacante debe tener permiso para crear o editar una plantilla de correo electrónico. Para que la carga útil sea ejecutada con éxito, el usuario atacado debe previsualizar una plantilla de correo electrónico vulnerable. No se presentan medidas de mitigación que aborden esta vulnerabilidad. Se aconseja a usuarios que actualicen lo antes posible

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Medium
Authentication
Single
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-09-15 CVE Reserved
  • 2022-01-04 CVE Published
  • 2023-07-28 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oroinc
Search vendor "Oroinc"
 Oroplatform
Search vendor "Oroinc" for product "Oroplatform"
 >= 3.1.0 < 3.1.21
Search vendor "Oroinc" for product "Oroplatform" and version " >= 3.1.0 < 3.1.21"
-
Affected
Oroinc
Search vendor "Oroinc"
 Oroplatform
Search vendor "Oroinc" for product "Oroplatform"
 >= 4.1.0 < 4.1.14
Search vendor "Oroinc" for product "Oroplatform" and version " >= 4.1.0 < 4.1.14"
-
Affected
Oroinc
Search vendor "Oroinc"
 Oroplatform
Search vendor "Oroinc" for product "Oroplatform"
 >= 4.2.0 < 4.2.8
Search vendor "Oroinc" for product "Oroplatform" and version " >= 4.2.0 < 4.2.8"
-
Affected