Lucene search

GitHub Advisory DatabaseGHSA-QC2P-6QRF-25J2

HistoryMay 24, 2022 - 10:00 p.m.

laracom Cross-site Scripting

2022-05-2422:00:24

CWE-79

GitHub Advisory Database

github.com

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.5%

JSON

laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has a Cross-site Scripting vulnerability via search query.

Affected configurations

Vulners

Node

jsdecenalaracomMatch1.4.11

CPENameOperatorVersion
jsdecena/laracomeq1.4.11

CPE	Name	Operator	Version
	jsdecena/laracom	eq	1.4.11

References

github.com/advisories/GHSA-qc2p-6qrf-25j2

github.com/jsdecena/laracom/commit/36ff6a5c4a7878c719304e9d9a5f1fc74a5af474

github.com/Laracommerce/laracom/pull/211

nvd.nist.gov/vuln/detail/CVE-2019-15489

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

37.5%

JSON

Related for GHSA-QC2P-6QRF-25J2