CVE-2020-8176 - A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint

Back Back to CVE browser

MEDIUM

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint

Published Jul 2, 2020

6.1

MEDIUM

CVSS 3.1

EPSS 0.98%

Description

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the `shop` parameter on the `/shopify/auth/enable_cookies` endpoint.

Affected products

Vendor n/a Product Koa-Shopify-Auth Default
unknown
Affected
- Impacted: v3.1.61-v3.1.62, Fixed: v3.1.63

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Koa-Shopify-Auth	unknown	Affected Impacted: v3.1.61-v3.1.62, Fixed: v3.1.63

Ecosystem	Package	Introduced	Fixed
npm	@shopify/koa-shopify-auth	3.1.61	3.1.63

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1124
Advisory
https://github.com/Shopify/quilt/pull/1455
x_refsource_MISCExploitPatchThird Party Advisory
https://github.com/advisories/GHSA-jqh7-w5pr-cr56
Advisory
https://hackerone.com/reports/881409
x_refsource_MISCPermissions Required
https://nvd.nist.gov/vuln/detail/CVE-2020-8176

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1124		Advisory
https://github.com/Shopify/quilt/pull/1455		x_refsource_MISCExploitPatchThird Party Advisory
https://github.com/advisories/GHSA-jqh7-w5pr-cr56		Advisory
https://hackerone.com/reports/881409		x_refsource_MISCPermissions Required
https://nvd.nist.gov/vuln/detail/CVE-2020-8176