CVE-2019-15489: Cross-site Scripting in laracom
Summary
CVE-2019-15489: laracom Cross-site Scripting. Affects jsdecena/laracom versions >= 1.4.11, < 1.5.0. Fixed in 1.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
laracom is an open-source e-commerce software built on Laravel framework. It provides various features for creating and managing online stores. The laracom version 1.4.11 is affected by a Cross-site Scripting (XSS) vulnerability that can be exploited through the search query functionality.
Vulnerability Detail
The Cross-site Scripting vulnerability in laracom version 1.4.11 allows an attacker to inject malicious scripts into the search query parameter. This can lead to the execution of arbitrary code or the theft of sensitive information from users who interact with the vulnerable application. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
1.5.0
This is the first release that contains the fix.
composer require jsdecena/laracom:1.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
laracom version 1.4.11 is vulnerable to a Cross-site Scripting (XSS) attack. To ensure the security of your application, it is recommended to upgrade to version 1.5.0 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for jsdecena/laracom →
FAQ
laracom is an open-source e-commerce software based on Laravel framework, designed to help developers create and manage online stores.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code or the theft of sensitive information.
The Cross-site Scripting vulnerability in laracom allows attackers to inject malicious scripts into the search query parameter. When users interact with the vulnerable application and perform a search, the injected scripts can be executed, potentially leading to the execution of arbitrary code or the theft of sensitive information.
Yes, the vulnerability can be fixed by upgrading laracom to version 1.5.0 or later. This version includes a patch that addresses the Cross-site Scripting vulnerability.
You can use Vulert's playground (https://vulert.com/scanner) to check if your laracom application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for jsdecena/laracom.
