CVE-2023-43706: Os Commerce 4.12.56860 - Cross Site Scripting Reflected (XSS)
Published Sep 30, 2023
·Updated
Os Commerce is currently susceptible to a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject JS through the "emailtemplateskey" parameter, potentially leading to unauthorized execution of scripts within a user's web browser.
Affected Software
1 affected component
osCommerce oscommerce=4.12.56860
Event History
Sep 30, 2023
CVE Published
via MITRE·01:46 AM
Data Sourced
via MITRE·01:46 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the CVE ID for this vulnerability?
The CVE ID for this vulnerability is CVE-2023-43706.
2
What is the severity of CVE-2023-43706?
The severity of CVE-2023-43706 is high with a CVSS score of 5.4.
3
How does this vulnerability affect Os Commerce?
This vulnerability affects Os Commerce versions 4.12.56860.
4
What is the Common Weakness Enumeration (CWE) for this vulnerability?
The CWE for this vulnerability is CWE-79.
5
How can I fix the XSS vulnerability in Os Commerce?
To fix the XSS vulnerability in Os Commerce, it is recommended to update to a patched version provided by Os Commerce. Additionally, input validation and output encoding should be implemented to sanitize user input and prevent script injection.