CVE-2020-29471: XSS
First published: Tue Dec 29 2020(Updated: )
OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/opencart/opencart | =3.0.3.6 | |
| OpenCart | =3.0.3.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this OpenCart vulnerability?
The vulnerability ID for this OpenCart vulnerability is CVE-2020-29471.
What is the severity level of CVE-2020-29471?
CVE-2020-29471 has a severity level of medium (4.8).
How does CVE-2020-29471 impact OpenCart?
CVE-2020-29471 allows an admin to upload a profile image that contains malicious JavaScript code, which can lead to cross-site scripting (XSS) attacks in OpenCart 3.0.3.6.
How can an admin exploit CVE-2020-29471?
An admin can upload a profile image with JavaScript code that will be executed whenever someone views the profile picture, triggering the XSS vulnerability.
What is the recommended solution for CVE-2020-29471?
To mitigate the vulnerability, users should update OpenCart to a version that has addressed the XSS issue.
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-7vrp-3pff-c3j4
- alias/CVE-2020-29471
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/weakness
- agent/author
- agent/description
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- package-manager/composer
- vendor/opencart
- canonical/opencart
- version/opencart/3.0.3.6