CVE-2022-31037

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
oroinc	orocommerce	>= 4.1.0, <= 4.1.17; >= 4.2.0, <= 4.2.11; >= 5.0.0, <= 5.0.3

References

https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2Third Party Advisory
https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2Third Party Advisory

Timeline

Published: Oct 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-310385.4Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from user CVE-2022-310395.3Greenlight is a simple front-end interface for your BigBlueButton server. In affected versions an attacker can view any room's settings even CVE-2022-31045.5An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return valu CVE-2022-310406.1Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open For CVE-2022-310416.5Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These CVE-2022-310427.5Guzzle is an open source PHP HTTP client. In affected versions the `Cookie` headers on requests are sensitive information. On making a reque CVE-2022-310437.5Guzzle is an open source PHP HTTP client. In affected versions `Authorization` headers on requests are sensitive information. On making a re CVE-2022-310447.5Rundeck is an open source automation service with a web console, command line tools and a WebAPI. The Key Storage converter plugin mechanism CVE-2022-310459.8Istio is an open platform to connect, manage, and secure microservices. In affected versions ill-formed headers sent to Envoy in certain con CVE-2022-310464.3TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the ex CVE-2022-310476.5TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system CVE-2022-310485.4TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer b