CVE-2021-41236: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

January 4, 2022 (updated January 8, 2022)

OroPlatform is a PHP Business Application Platform.An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible.

References

github.com/oroinc/platform/commit/2a089c971fc70bc63baf8770d29ee515ce5a415a
github.com/oroinc/platform/security/advisories/GHSA-qv7g-j98v-8pp7
nvd.nist.gov/vuln/detail/CVE-2021-41236

Code Behaviors & Features

Detect and mitigate CVE-2021-41236 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →