XSS vulnerability in translations
Priority LOW 38Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Summary An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via: - Translation management UI. - Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed. - Translations uploaded via Upload translation file on the All Languages grid ### Workarounds There are no workarounds that address this vulnerability.
Why it matters now
Fix Fixed oro/platform (Packagist): 3.1.29, 4.1.17, 4.2.8
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | oro/platform (Packagist) | 3.1.0 to before 3.1.29 | 3.1.29 | Patch available | GHSA-rrgw-3hg3-9x8c |
| — | oro/platform (Packagist) | 4.1.0 to before 4.1.17 | 4.1.17 | Patch available | GHSA-rrgw-3hg3-9x8c |
| — | oro/platform (Packagist) | 4.2.0 to before 4.2.8 | 4.2.8 | Patch available | GHSA-rrgw-3hg3-9x8c |
- oro/platform (Packagist) Vendor— Affected 3.1.0 to before 3.1.29 Fixed in 3.1.29 Patch available GHSA-rrgw-3hg3-9x8c
- oro/platform (Packagist) Vendor— Affected 4.1.0 to before 4.1.17 Fixed in 4.1.17 Patch available GHSA-rrgw-3hg3-9x8c
- oro/platform (Packagist) Vendor— Affected 4.2.0 to before 4.2.8 Fixed in 4.2.8 Patch available GHSA-rrgw-3hg3-9x8c
Remediation
- Fix · GHSA-rrgw-3hg3-9x8c oro/platform (Packagist) Fixed in 3.1.29 Advisory →
- Fix · GHSA-rrgw-3hg3-9x8c oro/platform (Packagist) Fixed in 4.1.17 Advisory →
- Fix · GHSA-rrgw-3hg3-9x8c oro/platform (Packagist) Fixed in 4.2.8 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-rrgw-3hg3-9x8c
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences