// For flags

CVE-2022-31037

OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page

Severity Score

5.4
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds.

OroCommerce es una aplicación de comercio entre empresas de código abierto. Las versiones entre 4.1.0 y 4.1.17 incluyéndola, 4.2.0 y 4.2.11 incluyéndola, y entre 5.0.0 y 5.0.3 incluyéndola, son vulnerables a un ataque de tipo Cross-site Scripting en el campo UPS Surcharge de la página de edición de reglas de envío. El atacante necesita permiso para crear o editar una regla de envío. Este problema ha sido corregido en versión 5.0.6. No se presentan mitigaciones conocidas

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
Low
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-05-18 CVE Reserved
  • 2022-10-18 CVE Published
  • 2024-05-10 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (1)
URL Tag Source
https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2 Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Oroinc
Search vendor "Oroinc"
 Orocommerce
Search vendor "Oroinc" for product "Orocommerce"
 >= 4.1.0 <= 4.1.17
Search vendor "Oroinc" for product "Orocommerce" and version " >= 4.1.0 <= 4.1.17"
-
Affected
Oroinc
Search vendor "Oroinc"
 Orocommerce
Search vendor "Oroinc" for product "Orocommerce"
 >= 4.2.0 <= 4.2.11
Search vendor "Oroinc" for product "Orocommerce" and version " >= 4.2.0 <= 4.2.11"
-
Affected
Oroinc
Search vendor "Oroinc"
 Orocommerce
Search vendor "Oroinc" for product "Orocommerce"
 >= 5.0.0 <= 5.0.3
Search vendor "Oroinc" for product "Orocommerce" and version " >= 5.0.0 <= 5.0.3"
-
Affected