Broadleaf vulnerable to Cross-site Scripting

MOYENNE 6.1CVE-2023-33725 · GHSA-3862-fmr3-4f3h · Published 21/06/2023 · updated 17/06/2026

En bref

CVE-2023-33725 est une vulnérabilité MOYENNE (CVSS 6.1) touchant org.broadleafcommerce:broadleaf, broadleaf commerce (broadleafcommerce).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.50%, plus élevée que 42.9% des vulnérabilités.
Correctif : mettre à jour vers 6.2.7-GA, 6.2.6.1-ga ou plus récent.

Package	Affected versions	Patched versions
org.broadleafcommerce:broadleaf Maven	`≥ 5.0.0-GA, < 6.2.7-GA`	`6.2.7-GA`
broadleaf commerce broadleafcommerce	`≥ 5.0, ≤ 5.2.25-ga≥ 6.0, < 6.2.6.1-ga`	`6.2.6.1-ga`

Description

Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.7-GA.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2023-33725 · ADVISORY
BroadleafCommerce/BroadleafCommerce · PACKAGE
Contrast-Security-OSS/Burptrast · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free