medium6.9
CVE-2022-31037
OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration
Impact
### Impact Shipping rule edit page is vulnerable to cross site scripting (XSS) payload added to UPS Surcharge field. The attacker should have permission to create or edit a shipping rule.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | oro/commerce | >= 4.1.0, < 5.0.6 | 5.0.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Oroinc | Orocommerce | from 4.1.0 through 4.1.17 from 4.2.0 through 4.2.11 from 5.0.0 through 5.0.3 |