What is GHSA-xrh7-2gfq-4rcq?

GHSA-xrh7-2gfq-4rcq is a security advisory published by GitHub Security Advisories with Medium severity. openCart Server-Side Template Injection (SSTI) vulnerability

Which CVE IDs does GHSA-xrh7-2gfq-4rcq cover?

GHSA-xrh7-2gfq-4rcq covers the following CVE IDs: CVE-2024-36694. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-xrh7-2gfq-4rcq?

GHSA-xrh7-2gfq-4rcq has a CVSS v3 base score of 8.0, published by GitHub Security Advisories.

Which products are affected by GHSA-xrh7-2gfq-4rcq?

GHSA-xrh7-2gfq-4rcq affects 1 product, including: composer/opencart/opencart:\u003c= 4.0.2.3.

GHSA-xrh7-2gfq-4rcqMediumCVSS 8.0

openCart Server-Side Template Injection (SSTI) vulnerability

Vendor

GitHub Security Advisories

Published

July 17, 2024

Last Modified

December 18, 2024

🔗 CVE IDs covered (1)

CVE-2024-36694 →

📋 Description

A Server-Side Template Injection (SSTI) vulnerability in the Theme Editor Function of openCart project v4.0.2.3 allows attackers to execute arbitrary code via injecting a crafted payload.

🎯 Affected products1

composer/opencart/opencart:<= 4.0.2.3

🔗 References (6)

https://github.com/A3h1nt/CVEs/blob/main/OpenCart/Readme.md
https://nvd.nist.gov/vuln/detail/CVE-2024-36694
https://github.com/opencart/opencart/issues/13863
https://github.com/opencart/opencart/releases/tag/4.0.2.3
https://medium.com/@pawarit.sanguanpang/opencart-v4-0-2-3-server-side-template-injection-0b173a3bdcf9
https://github.com/advisories/GHSA-xrh7-2gfq-4rcq