Description

OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image. An admin can upload a profile image as a malicious code using JavaScript. Whenever anyone will see the profile picture, the code will execute and XSS will trigger.

Remediation

References

CVE-2020-29471

Related Vulnerabilities

WebLogic CVE-2019-2645 Vulnerability (CVE-2019-2645)

WordPress Plugin WHIZZ Cross-Site Request Forgery (1.1)

phpMyAdmin Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-12922)

WordPress Plugin iTwitter Multiple Vulnerabilities (0.04)

WordPress Plugin Qualified Electronic Signatures by eID Easy Supply Chain Attack [Polyfill.io] (3.3.0)

Severity

Medium

Classification

CVE-2020-29471 CWE-707 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities