Vulnerability Description
OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.
CVSS Score
4.8
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Opencart | Opencart | >= 3.0.0.0, <= 3.0.3.2 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/154286/Opencart-3.x-Cross-Site-Scripting.htBroken Link
- https://github.com/nipunsomani/Opencart-3.x.x-Authenticated-Stored-XSS/blob/mastExploitThird Party Advisory
- http://packetstormsecurity.com/files/154286/Opencart-3.x-Cross-Site-Scripting.htBroken Link
- https://github.com/nipunsomani/Opencart-3.x.x-Authenticated-Stored-XSS/blob/mastExploitThird Party Advisory
FAQ
What is CVE-2019-15081?
CVE-2019-15081 is a vulnerability with a CVSS score of 4.8 (MEDIUM). OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages.
How severe is CVE-2019-15081?
CVE-2019-15081 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-15081?
Check the references section above for vendor advisories and patch information. Affected products include: Opencart Opencart.