CVE-2024-4348 - osCommerce all-products cross site scripting

Back Back to CVE browser

MEDIUM

osCommerce all-products cross site scripting

Published Apr 30, 2024

4.3

MEDIUM

CVSS 3.1

EPSS 1.83%

Description

A vulnerability, which was classified as problematic, was found in osCommerce 4. Affected is an unknown function of the file /catalog/all-products. The manipulation of the argument cat leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-262488. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor n/a Product osCommerce Default
n/a
- Version
  4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

osCommerce

n/a

Version	Status	Constraints
4	affected	-

Vendor Oscommerce Product Oscommerce Default
n/a
- Version
  4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oscommerce

n/a

Version	Status	Constraints
4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://vuldb.com/?ctiid.262488
signaturepermissions-required
https://vuldb.com/?id.262488
vdb-entrytechnical-description
https://vuldb.com/?submit.320855
third-party-advisory

Link	Providers	Tags
https://vuldb.com/?ctiid.262488		signaturepermissions-required
https://vuldb.com/?id.262488		vdb-entrytechnical-description
https://vuldb.com/?submit.320855		third-party-advisory