GHSA-rrgw-3hg3-9x8c
XSS vulnerability in translations
GHSA-rrgw-3hg3-9x8c is a medium vulnerability (CVSS 6.9) in oro/platform, published January 12, 2022. No source lists public exploit code. Fixed in oro/platform 3.1.29.
- Severity
- 6.9 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.1.29oro/platform +5 more
Description
Summary
An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via:
- Translation management UI.
- Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
- Translations uploaded via Upload translation file on the All Languages grid
Workarounds
There are no workarounds that address this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
oro/platformPackagist | 3.1.0 up to 3.1.29 | 3.1.29 |
oro/platformPackagist | 4.1.0 up to 4.1.17 | 4.1.17 |
oro/platformPackagist | 4.2.0 up to 4.2.8 | 4.2.8 |
oro/platformPackagist | 3.1.0 up to 3.1.29, plus listed versions 3.1.13.1.103.1.113.1.123.1.13 Show 15 moreShow less3.1.143.1.153.1.163.1.173.1.183.1.193.1.23.1.203.1.33.1.43.1.53.1.63.1.73.1.83.1.9 | 3.1.29 |
oro/platformPackagist | 4.1.0 up to 4.1.17, plus listed versions 4.1.14.1.1-rc4.1.1-rc24.1.104.1.11 Show 10 moreShow less4.1.124.1.134.1.24.1.34.1.44.1.54.1.64.1.74.1.84.1.9 | 4.1.17 |
oro/platformPackagist | 4.2.0 up to 4.2.8, plus listed versions 4.2.14.2.24.2.34.2.44.2.54.2.64.2.7 | 4.2.8 |
What each source reports
GitHub Advisories Score used
XSS vulnerability in translations
Summary
An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via:
- Translation management UI.
- Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
- Translations uploaded via Upload translation file on the All Languages grid
Workarounds
There are no workarounds that address this vulnerability.
- Record
GHSA-rrgw-3hg3-9x8c- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
OSV
XSS vulnerability in translations
Summary
An attacker with admin privileges and access to Translations management functionality may add JS payload to translation values via:
- Translation management UI.
- Translations downloaded via the Crowdin service may also contain JS strings used for XSS attacks, for a successful attack poisoned translation should be enabled, downloaded, and installed.
- Translations uploaded via Upload translation file on the All Languages grid
Workarounds
There are no workarounds that address this vulnerability.
- Record
GHSA-rrgw-3hg3-9x8c- CVSS 3.1
- 6.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.