CVE-2022-31037 - Vulnerability Details - OpenCVE

OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0008.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Oroinc	Orocommerce

Configuration 1 [-]

OR	cpe:2.3:a:oroinc:orocommerce::::::::
	cpe:2.3:a:oroinc:orocommerce::::::::
	cpe:2.3:a:oroinc:orocommerce::::::::

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2

History

Sun, 13 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00063}`	epss `{'score': 0.00079}`

Wed, 23 Apr 2025 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-10-18T00:00:00.000Z

Updated: 2025-04-23T16:45:45.109Z

Reserved: 2022-05-18T00:00:00.000Z

Link: CVE-2022-31037

Vulnrichment

Updated: 2024-08-03T07:03:40.301Z

NVD

Status : Modified

Published: 2022-10-18T10:15:10.383

Modified: 2024-11-21T07:03:45.757

Link: CVE-2022-31037

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-31037", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "dateUpdated": "2025-04-23T16:45:45.109Z", "dateReserved": "2022-05-18T00:00:00.000Z", "datePublished": "2022-10-18T00:00:00.000Z"}, "containers": {"cna": {"title": "OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page", "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-10-18T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds."}], "affected": [{"vendor": "oroinc", "product": "orocommerce", "versions": [{"version": ">= 4.1.0, <= 4.1.17", "status": "affected"}, {"version": ">= 4.2.0, <= 4.2.11 ", "status": "affected"}, {"version": ">= 5.0.0, <= 5.0.3", "status": "affected"}]}], "references": [{"url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79"}]}], "source": {"advisory": "GHSA-4vf4-955g-vxp2", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T07:03:40.301Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-23T13:56:12.466489Z", "id": "CVE-2022-31037", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T16:45:45.109Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T07:03:40.301Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-31037", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-23T13:56:12.466489Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-23T13:56:14.250Z"}}], "cna": {"title": "OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page", "source": {"advisory": "GHSA-4vf4-955g-vxp2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "oroinc", "product": "orocommerce", "versions": [{"status": "affected", "version": ">= 4.1.0, <= 4.1.17"}, {"status": "affected", "version": ">= 4.2.0, <= 4.2.11 "}, {"status": "affected", "version": ">= 5.0.0, <= 5.0.3"}]}], "references": [{"url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2"}], "descriptions": [{"lang": "en", "value": "OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2022-10-18T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-31037", "state": "PUBLISHED", "dateUpdated": "2025-04-23T16:45:45.109Z", "dateReserved": "2022-05-18T00:00:00.000Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2022-10-18T00:00:00.000Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "3B2E64AD-7486-4B83-9F78-C9CF58F13901", "versionEndIncluding": "4.1.17", "versionStartIncluding": "4.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F0DBDA7-13AC-42A1-B74A-B5AAFD7AA299", "versionEndIncluding": "4.2.11", "versionStartIncluding": "4.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oroinc:orocommerce:*:*:*:*:*:*:*:*", "matchCriteriaId": "7100B052-D2C8-4D9C-A055-CCA84A7D5432", "versionEndIncluding": "5.0.3", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds."}, {"lang": "es", "value": "OroCommerce es una aplicaci\u00f3n de comercio entre empresas de c\u00f3digo abierto. Las versiones entre 4.1.0 y 4.1.17 incluy\u00e9ndola, 4.2.0 y 4.2.11 incluy\u00e9ndola, y entre 5.0.0 y 5.0.3 incluy\u00e9ndola, son vulnerables a un ataque de tipo Cross-site Scripting en el campo UPS Surcharge de la p\u00e1gina de edici\u00f3n de reglas de env\u00edo. El atacante necesita permiso para crear o editar una regla de env\u00edo. Este problema ha sido corregido en versi\u00f3n 5.0.6. No se presentan mitigaciones conocidas"}], "id": "CVE-2022-31037", "lastModified": "2024-11-21T07:03:45.757", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-10-18T10:15:10.383", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/oroinc/orocommerce/security/advisories/GHSA-4vf4-955g-vxp2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}