@vendure/admin-ui-plugin authenticated Cross-site Scripting vulnerability
Impact
Vendure provides an authorization system with different levels of privileges. For example, an administrator cannot create another administrator.
In the admin UI, there are a couple of places with description inputs, such as inventory/collection catalog, shipping methods, promotions, and more.
While the WYSIWYG editor allows limited customization, altering the request data (not in the ui) saves and returns arbitrary HTML with no sanitization. Causing an XSS when viewing the page.
The impact of this XSS is privilege escalation. A user that can write any type of description can trigger the attack. Then any other user that visits the vulnerable page is prone to arbitrary Javascript code execution, giving the attacker ability to execute actions on behalf of this user.
Patches
in progress
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
References
Are there any links users can visit to find out more?
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de npm | @vendure/admin-ui-plugin | < 2.0.3 | 2.0.3 |
Referencias
- https://github.com/vendure-ecommerce/vendure/security/advisories/GHSA-gm68-572p-q28r
- https://github.com/vendure-ecommerce/vendure/commit/0cdc92b241e6fd4017ddfc9fbdca189fc7c1ada0
- https://github.com/vendure-ecommerce/vendure
- https://github.com/vendure-ecommerce/vendure/blob/master/CHANGELOG.md#203-2023-07-04
- Debilidad (CWE)
CWE-79- Plataforma
- npm
- Paquete
@vendure/admin-ui-plugin- Publicada
- 06.07.2023
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-gm68-572p-q28r - CC BY 4.0
Historial de vulnerabilidades: @vendure/admin-ui-plugin
Todas las vulnerabilidades publicadas de este paquete (Paquete de npm), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.