What is GHSA-rrgw-3hg3-9x8c?

GHSA-rrgw-3hg3-9x8c is a security advisory published by GitHub Security Advisories with Medium severity. XSS vulnerability in translations

Why does GHSA-rrgw-3hg3-9x8c have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-rrgw-3hg3-9x8c?

GHSA-rrgw-3hg3-9x8c has a CVSS v3 base score of 6.9, published by GitHub Security Advisories.

Which products are affected by GHSA-rrgw-3hg3-9x8c?

GHSA-rrgw-3hg3-9x8c affects 3 products, including: composer/oro/platform:\u003e= 3.1.0, \u003c 3.1.29; composer/oro/platform:\u003e= 4.1.0, \u003c 4.1.17; composer/oro/platform:\u003e= 4.2.0, \u003c 4.2.8.

GHSA-rrgw-3hg3-9x8cMediumCVSS 6.9Disclosed before NVD

XSS vulnerability in translations

Vendor

GitHub Security Advisories

Published

January 12, 2022

Last Modified

January 11, 2023

📋 Description

Summary

An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via:

Translation management UI.
Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
Translations uploaded via Upload translation file on the All Languages grid

Workarounds

There are no workarounds that address this vulnerability.

🎯 Affected products3

composer/oro/platform:>= 3.1.0, < 3.1.29
composer/oro/platform:>= 4.1.0, < 4.1.17
composer/oro/platform:>= 4.2.0, < 4.2.8

🔗 References (2)

https://github.com/oroinc/platform-er/security/advisories/GHSA-rrgw-3hg3-9x8c
https://github.com/advisories/GHSA-rrgw-3hg3-9x8c