XSS Vulnerability in Translations - oro/platform
Summary
GHSA-rrgw-3hg3-9x8c: XSS vulnerability in translations. Affects oro/platform across 3 version ranges.
>= 3.1.0, < 3.1.29
>= 4.1.0, < 4.1.17
>= 4.2.0, < 4.2.8
Fixed in 3.1.29, 4.1.17 or 4.2.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
oro/platform is an open-source package available on Packagist. It provides a platform for building and managing web applications. The package includes functionality for managing translations, allowing administrators to add, update, and download translation files. However, a vulnerability has been discovered in the translations management functionality, which could allow an attacker with admin privileges to inject malicious JavaScript code into translation values.
Vulnerability Detail
The XSS vulnerability in translations allows an attacker with admin privileges to add JS payload to translation values through various means. This includes using the Translation management UI, downloading translations via the Crowdin service, or uploading translations via the All Languages grid. To successfully exploit this vulnerability, the attacker would need to enable a poisoned translation, download it, and install it. The injected JavaScript code can then be executed in the context of the affected application, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.1.0, < 3.1.293.1.29composer require oro/platform:3.1.29 -
>= 4.1.0, < 4.1.174.1.17composer require oro/platform:4.1.17 -
>= 4.2.0, < 4.2.84.2.8composer require oro/platform:4.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds that address this vulnerability. It is recommended to apply the fix by updating the oro/platform package to the fixed versions.
Conclusion
The XSS vulnerability in translations of the oro/platform package can allow an attacker with admin privileges to inject malicious JavaScript code. To mitigate this risk, it is recommended to update the package to the fixed versions. Regularly updating the package and staying informed about security vulnerabilities is crucial for maintaining the security of your application. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for oro/platform →
FAQ
This vulnerability allows an attacker with admin privileges to inject malicious JavaScript code into translation values. This can lead to various security risks, including unauthorized access, data theft, and other malicious activities.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
There are currently no known public exploits for this vulnerability. However, it is important to apply the fix as soon as possible to mitigate the risk.
No, this vulnerability requires an attacker to have admin privileges and access to the Translations management functionality. It cannot be exploited remotely without proper authentication and access.
Yes, the CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for oro/platform.
