PT-2020-17089
CVE-2020-29070
·
تاريخ النشر
2020-11-25
·
تاريخ التحديث
2020-11-27
الوصف من
CVSS 3.1
4.8
متوسطةالمقاييسAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
osCommerce version 2.3.4.1
Description
The issue allows an authenticated user to enter an XSS payload into the title section of newsletters, potentially leading to a cross-site scripting vulnerability.
Recommendations
For osCommerce version 2.3.4.1, consider restricting access to the newsletter title section for authenticated users until a fix is available. As a temporary workaround, validate and sanitize all user input in the title section to prevent XSS payload execution.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾