CVE-2020-8176

2020-07-0218:35:21

CWE-79

hackerone

www.cve.org

EPSS

0.001

Percentile

40.7%

JSON

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enable_cookies endpoint.

CNA Affected

[
  {
    "product": "koa-shopify-auth",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Impacted: v3.1.61-v3.1.62, Fixed: v3.1.63"
      }
    ]
  }
]

References

github.com/Shopify/quilt/pull/1455

hackerone.com/reports/881409

EPSS

0.001

Percentile

40.7%

JSON

Related for CVELIST:CVE-2020-8176