{"id":"CVE-2022-31037","aliases":["EUVD-2022-7019","GHSA-4vf4-955g-vxp2"],"status":"published","title":"OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page","description":"OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds.","severity":{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00503,"percentile":0.43394,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-10-18T00:00:00Z","modified":"2026-10-28T02:30:44Z","fixes":[{"ecosystem":"Packagist","package":"oro/commerce","fixed_in":["5.0.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"oro/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"5.0.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"oro/commerce","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.0"},{"fixed":"5.0.6"}]}],"versions":["4.1.0","4.1.1","4.1.1-rc","4.1.1-rc2","4.1.10","4.1.11","4.1.12","4.1.13","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.2.0","4.2.0-alpha","4.2.0-alpha.1","4.2.0-alpha.2","4.2.0-alpha.3","4.2.0-beta","4.2.0-rc","4.2.1","4.2.10","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","4.2.9","5.0.0","5.0.0-alpha.1","5.0.0-alpha.2","5.0.0-beta.1","5.0.0-beta.2","5.0.0-rc","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5"]}],"products":[{"vendor":"oroinc","product":"orocommerce"}],"references":[{"url":"https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31037","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4vf4-955g-vxp2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31037.json","tags":["advisory"]},{"url":"https://github.com/oroinc/orocommerce","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-31037","title":"OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page","description":"OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds.","status":"published","published":"2022-10-18T00:00:00Z","modified":"2025-04-23T16:45:45.109Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-7019","description":"OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds.","status":"published","published":"2022-10-18T00:00:00Z","modified":"2025-04-23T16:45:45Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:11.891054Z"}],"ghsa":[{"id":"GHSA-4vf4-955g-vxp2","title":"OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration","description":"### Impact\nShipping rule edit page is vulnerable to cross site scripting (XSS) payload added to UPS Surcharge field. The attacker should have permission to create or edit a shipping rule.","status":"published","published":"2022-10-18T19:52:25Z","modified":"2023-01-30T05:07:04Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:28.424013Z"}],"nvd":[{"id":"CVE-2022-31037","description":"OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds.","status":"published","published":"2022-10-18T10:15:10.383Z","modified":"2026-06-17T04:44:39.657Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:30.6869Z"}],"osv":[{"id":"CVE-2022-31037","title":"OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page","description":"OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds.","status":"published","published":"2022-10-18T00:00:00Z","modified":"2026-10-28T02:30:44.388966208Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"GHSA-4vf4-955g-vxp2","title":"OroCommerce Cross site scripting vulnerability during shipping rule editing for UPS integration","description":"### Impact\nShipping rule edit page is vulnerable to cross site scripting (XSS) payload added to UPS Surcharge field. The attacker should have permission to create or edit a shipping rule.","status":"published","published":"2022-10-18T19:52:25Z","modified":"2023-11-08T04:09:23.576414Z","cvss":[{"version":"3.1","score":6.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:37.528068Z"}]}}