medium4.8
CVE-2022-35950
OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item
Impact
### Impact The JS payload added to the product name may be executed at the storefront when adding a note to the shopping list line item containing a vulnerable product. An attacker should be able to edit a product in the admin area and force a user to add this product to Shopping List and click add a note for it.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | oro/commerce | >= 4.1.0, <= 4.1.13 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Oroinc | Orocommerce | from 4.1.0 through 4.1.13 from 4.2.0 through 4.2.10 from 5.0.0 through 5.0.10 Version 5.1.0 |