GHSA-RRGW-3HG3-9X8C中危已审查

XSS vulnerability in translations

OSV 1.4.0 · github-reviewed · 修改于 2022-01-11 05:39

发布时间

2022-01-13 05:49

GitHub 审查时间

2022-01-11 05:39

NVD 发布时间

—

源文件

advisories/github-reviewed/2022/01/GHSA-rrgw-3hg3-9x8c/GHSA-rrgw-3hg3-9x8c.json

公告说明

Summary

An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via:

Translation management UI.
Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
Translations uploaded via Upload translation file on the All Languages grid

Workarounds

There are no workarounds that address this vulnerability.

受影响的软件包

Packagist

oro/platform

ECOSYSTEM

3.1.0

标识信息

别名 / CVE

无

CWE

无

软件生态

Packagist

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V3

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

原始 OSV JSON

{
  "id": "GHSA-rrgw-3hg3-9x8c",
  "aliases": [],
  "details": "### Summary\n\nAn attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: \n - Translation management UI.\n - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.\n - Translations uploaded via Upload translation file on the All Languages grid\n\n### Workarounds\n\nThere are no workarounds that address this vulnerability.",
  "summary": "XSS vulnerability in translations",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "3.1.0"
            },
            {
              "fixed": "3.1.29"
            }
          ]
        }
      ],
      "package": {
        "name": "oro/platform",
        "ecosystem": "Packagist"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.17"
            }
          ]
        }
      ],
      "package": {
        "name": "oro/platform",
        "ecosystem": "Packagist"
      }
    },
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "4.2.0"
            },
            {
              "fixed": "4.2.8"
            }
          ]
        }
      ],
      "package": {
        "name": "oro/platform",
        "ecosystem": "Packagist"
      }
    }
  ],
  "modified": "2022-01-10T21:39:18Z",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N"
    }
  ],
  "published": "2022-01-12T21:49:49Z",
  "references": [
    {
      "url": "https://github.com/oroinc/platform-er/security/advisories/GHSA-rrgw-3hg3-9x8c",
      "type": "WEB"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2022-01-10T21:39:18Z"
  }
}