{"action":"Upgrade oro/commerce to 5.0.4 or later.","affected":[{"fixed":"5.0.4","introduced":"5.0"}],"component":"oro/commerce","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["5.0.4"],"ghsa_id":"GHSA-6f85-3f8q-qc94","id":"tcs_01M5KEWZK7HZW78WERYYY52SFC","modified_at":"2024-12-08T05:39:08.302350Z","published_at":"2022-07-15T19:25:06Z","references":["https://osv.dev/vulnerability/GHSA-6f85-3f8q-qc94","https://github.com/oroinc/orocommerce/security/advisories/GHSA-6f85-3f8q-qc94","https://github.com/artf/grapesjs/issues/4411","https://github.com/oroinc/orocommerce"],"severity":{"label":"medium","score":6.9},"sources":[{"source":"osv","source_id":"GHSA-6f85-3f8q-qc94","url":"https://osv.dev/vulnerability/GHSA-6f85-3f8q-qc94"}],"summary":"OroCommerce vulnerable to XSS when adding class name to Selector Manager on pages that use GrapeJS editor"}