Thelia BackOffice default template vulnerable to Cross-site Scripting
Summary
GHSA-pp7v-wxx9-hm6r: Thelia BackOffice default template vulnerable to Cross-site Scripting. Affects thelia/backoffice-default-template versions >= 2.1.0, < 2.1.2. Fixed in 2.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Thelia is an open-source e-commerce platform that allows users to create and manage online stores. The BackOffice is a web-based administration interface provided by Thelia for managing various aspects of the online store. The default template used in the BackOffice is vulnerable to a cross-site scripting (XSS) attack. This vulnerability affects Thelia versions 2.1.0 and 2.1.1, but not version 2.0.X. A patch has been released in version 2.1.2 to address this issue.
Vulnerability Detail
The cross-site scripting vulnerability in the Thelia BackOffice default template allows an attacker to inject malicious code into the error.html template. This can be exploited by tricking an authenticated user with access to the BackOffice into visiting a specially crafted URL or clicking on a malicious link. When the user encounters an error page, the injected code will be executed in their browser, potentially leading to unauthorized actions, data theft, or further compromise of the system. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.1.2
This is the first release that contains the fix.
composer require thelia/backoffice-default-template:2.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version to mitigate the risk of exploitation.
Conclusion
The Thelia BackOffice default template is vulnerable to cross-site scripting (XSS) attacks in versions 2.1.0 and 2.1.1. Users of Thelia are advised to update to version 2.1.2 or later to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for thelia/backoffice-default-template →
FAQ
Thelia is an open-source e-commerce platform that allows users to create and manage online stores.
The BackOffice is a web-based administration interface provided by Thelia for managing various aspects of the online store.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
This vulnerability allows an attacker to execute arbitrary code in the browser of an authenticated user with access to the Thelia BackOffice, potentially leading to unauthorized actions, data theft, or further compromise of the system.
To fix this vulnerability, update Thelia to version 2.1.2 or later, which includes a patch for the cross-site scripting issue in the BackOffice default template.
