XSS vulnerability on email template preview page

TRUNG BÌNH 4.8CVE-2021-41236 · GHSA-qv7g-j98v-8pp7 · Công bố 04/01/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2021-41236 là lỗ hổng mức TRUNG BÌNH (CVSS 4.8) ảnh hưởng oro/platform, oroplatform (oroinc).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.69%, cao hơn 53.0% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.1.21, 4.1.14, 4.2.8 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
oro/platform Packagist	`≥ 3.1.0, < 3.1.21≥ 4.1.0, < 4.1.14≥ 4.2.0, < 4.2.8`	`3.1.214.1.144.2.8`
oroplatform oroinc	`≥ 3.1.0, < 3.1.21≥ 4.1.0, < 4.1.14≥ 4.2.0, < 4.2.8`	`3.1.214.1.144.2.8`

Mô tả

Summary

Email template preview is vulnerable to XSS payload added to email template content. The attacker should have permission to create or edit an email template. For successful payload, execution attacked user should preview a vulnerable email template.

Workarounds

There are no workarounds that address this vulnerability.

Mô tả của NVD

OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible.