OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item
Priority LOW 31CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
OroCommerce is an open-source Business to Business Commerce application. In versions 4.1.0 through 4.1.13, 4.2.0 through 4.2.10, 5.0.0 prior to 5.0.11, and 5.1.0 prior to 5.1.1, the JS payload added to the product name may be executed at the storefront when adding a note to the shopping list line item containing a vulnerable product. An attacker should be able to edit a product in the admin area and force a user to add this product to Shopping List and click add a note for it. Versions 5.0.11 and 5.1.1 contain a fix for this issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00413 35th percentileScored 2026-11-07
Fix Fixed orocommerce (oroinc): 5.0.11, 5.1.1oro/commerce (Packagist): 5.0.11, 5.1.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| oroinc | orocommerce | 4.1.0 – 4.1.13; 4.2.0 – 4.2.10; 5.0.0 to before 5.0.11; 5.1.0 to before 5.1.1 | 5.0.11, 5.1.1 | Patch available | CNA |
| — | oro/commerce (Packagist) | 4.1.0 – 4.1.13 | — | No fix listed | GHSA-2jc6-3fhj-8q84 |
| — | oro/commerce (Packagist) | 4.2.0 – 4.2.10 | — | No fix listed | GHSA-2jc6-3fhj-8q84 |
| — | oro/commerce (Packagist) | 5.0.0 to before 5.0.11 | 5.0.11 | Patch available | GHSA-2jc6-3fhj-8q84 |
| — | oro/commerce (Packagist) | 5.1.0 to before 5.1.1 | 5.1.1 | Patch available | GHSA-2jc6-3fhj-8q84 |
- orocommerce Vendororoinc Affected 4.1.0 – 4.1.13; 4.2.0 – 4.2.10; 5.0.0 to before 5.0.11; 5.1.0 to before 5.1.1 Fixed in 5.0.11, 5.1.1 Patch available CNA
- oro/commerce (Packagist) Vendor— Affected 4.1.0 – 4.1.13 Fixed in — No fix listed GHSA-2jc6-3fhj-8q84
- oro/commerce (Packagist) Vendor— Affected 4.2.0 – 4.2.10 Fixed in — No fix listed GHSA-2jc6-3fhj-8q84
- oro/commerce (Packagist) Vendor— Affected 5.0.0 to before 5.0.11 Fixed in 5.0.11 Patch available GHSA-2jc6-3fhj-8q84
- oro/commerce (Packagist) Vendor— Affected 5.1.0 to before 5.1.1 Fixed in 5.1.1 Patch available GHSA-2jc6-3fhj-8q84
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:* | 4.1.0 – 4.1.13; 4.2.0 – 4.2.10; 5.0.0 – 5.0.10 | Vulnerable | oroinc |
| cpe:2.3:a:oroinc:orocommerce:5.1.0:-:*:*:*:*:*:* | 5.1.0 | Vulnerable | oroinc |
| cpe:2.3:a:oroinc:orocommerce:5.1.0:alpha1:*:*:*:*:*:* | 5.1.0 alpha1 | Vulnerable | oroinc |
| cpe:2.3:a:oroinc:orocommerce:5.1.0:alpha2:*:*:*:*:*:* | 5.1.0 alpha2 | Vulnerable | oroinc |
| cpe:2.3:a:oroinc:orocommerce:5.1.0:beta1:*:*:*:*:*:* | 5.1.0 beta1 | Vulnerable | oroinc |
| cpe:2.3:a:oroinc:orocommerce:5.1.0:beta2:*:*:*:*:*:* | 5.1.0 beta2 | Vulnerable | oroinc |
| cpe:2.3:a:oroinc:orocommerce:5.1.0:rc1:*:*:*:*:*:* | 5.1.0 rc1 | Vulnerable | oroinc |
| cpe:2.3:a:oroinc:orocommerce:5.1.0:rc2:*:*:*:*:*:* | 5.1.0 rc2 | Vulnerable | oroinc |
- cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:* Versions 4.1.0 – 4.1.13; 4.2.0 – 4.2.10; 5.0.0 – 5.0.10 Vulnerable ·oroinc
- cpe:2.3:a:oroinc:orocommerce:5.1.0:-:*:*:*:*:*:* Versions 5.1.0 Vulnerable ·oroinc
- cpe:2.3:a:oroinc:orocommerce:5.1.0:alpha1:*:*:*:*:*:* Versions 5.1.0 alpha1 Vulnerable ·oroinc
- cpe:2.3:a:oroinc:orocommerce:5.1.0:alpha2:*:*:*:*:*:* Versions 5.1.0 alpha2 Vulnerable ·oroinc
- cpe:2.3:a:oroinc:orocommerce:5.1.0:beta1:*:*:*:*:*:* Versions 5.1.0 beta1 Vulnerable ·oroinc
- cpe:2.3:a:oroinc:orocommerce:5.1.0:beta2:*:*:*:*:*:* Versions 5.1.0 beta2 Vulnerable ·oroinc
- cpe:2.3:a:oroinc:orocommerce:5.1.0:rc1:*:*:*:*:*:* Versions 5.1.0 rc1 Vulnerable ·oroinc
- cpe:2.3:a:oroinc:orocommerce:5.1.0:rc2:*:*:*:*:*:* Versions 5.1.0 rc2 Vulnerable ·oroinc
Remediation
- Fix · CNA orocommerce (oroinc) Fixed in 5.0.11, 5.1.1
- Fix · GHSA-2jc6-3fhj-8q84 oro/commerce (Packagist) Fixed in 5.0.11 Advisory →
- Fix · GHSA-2jc6-3fhj-8q84 oro/commerce (Packagist) Fixed in 5.1.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2022-35950
- 2026-10-03 Alias added: GHSA-2jc6-3fhj-8q84
References
More oroinc Orocommerce vulnerabilities
- TI-2022-13082 OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page CVSS 3.1MEDIUM 6.9
- TI-2023-15369 OroCommerce get-totals-for-checkout API endpoint returns unwanted data CVSS 3.1MEDIUM 5.8
- TI-2023-15368 OroCommerce Customer Portal Incorrect Customer and Customer Group Frontend Menus pages visibility CVSS 3.1MEDIUM 5.0
Sources
- CVE-2022-35950 · CVE Program
- CVE-2022-35950 · NVD
- FIRST EPSS
- GHSA-2jc6-3fhj-8q84 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences