XSS vulnerability in translations

中 6.9GHSA-rrgw-3hg3-9x8c · 12/01/2022 公開 · 04/12/2024 更新

要点

パッケージ	影響を受けるバージョン	修正済みバージョン
oro/platform Packagist	`≥ 3.1.0, < 3.1.29≥ 4.1.0, < 4.1.17≥ 4.2.0, < 4.2.8`	`3.1.294.1.174.2.8`

An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via:

Translation management UI.
Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
Translations uploaded via Upload translation file on the All Languages grid

There are no workarounds that address this vulnerability.

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

パッケージ

影響を受けるバージョン

修正済みバージョン

Packagist

≥ 3.1.0, < 3.1.29≥ 4.1.0, < 4.1.17≥ 4.2.0, < 4.2.8

3.1.294.1.174.2.8

概要

An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via:

Translation management UI.
Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
Translations uploaded via Upload translation file on the All Languages grid

There are no workarounds that address this vulnerability.

oro/platform のその他の脆弱性

すべて見る →