CVE-2022-4601 - Shoplazza LifeStyle Shipping/Member Discount/Icon cross site scripting

Back Back to CVE browser

MEDIUM

Shoplazza LifeStyle Shipping/Member Discount/Icon cross site scripting

Published Dec 18, 2022

5.4

MEDIUM

CVSS 3.1

EPSS 0.53%

Description

A vulnerability was found in Shoplazza LifeStyle 1.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/api/theme-edit/ of the component Shipping/Member Discount/Icon. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216196.

Affected products

Vendor Shoplazza Product LifeStyle Default
n/a
- Version
  1.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Shoplazza

LifeStyle

n/a

Version	Status	Constraints
1.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-707

CWE-79

Cross-site Scripting (XSS)

References (3)

https://seclists.org/fulldisclosure/2022/Dec/11
Mailing ListThird Party Advisory
https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt
Mailing ListThird Party Advisory
https://vuldb.com/?id.216196
Third Party Advisory

Link	Providers	Tags
https://seclists.org/fulldisclosure/2022/Dec/11		Mailing ListThird Party Advisory
https://seclists.org/fulldisclosure/2022/Dec/att-11/proof-of-concept-shoplazza.txt		Mailing ListThird Party Advisory
https://vuldb.com/?id.216196		Third Party Advisory