search

EmicoEcommerce / Magento2Tweakwise-archived

Magento 2 module for Tweakwise integration
Other
9 stars 25 forks source link

XSS vulnerability in version 3.3.8 #247

Open kpapijnenburg opened 2 years ago

kpapijnenburg commented 2 years ago

Issue Brief

We use Tweakwise version 3.3.8 in our webshop. A routine vulnerability check has shown that there are cross site scripting (XSS) vulnerabilities in the code, see the attachment for more information.

xss_vulnerability.pdf

Environment

Steps to reproduce

  1. Copy the GET request from the xss_vulnerability.pdf (highlighted on the second page.)
  2. Execute the request.

Actual result

  1. The content of the script tag was executed.

Expected result

  1. The content of the script tag was not executed.
ah-net commented 2 years ago

I've added this issue to our work log. We will keep you informed.

ah-net commented 2 years ago

This issue is already fixed from version 4.2.0 and above.