CVE-2021-41236: OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template…

PriorityP420medium4.8CVSS 3.1

AVNACLPRHUIRSCCLILAN

EPSS

0.67%

48.3th percentile

OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
oro	platform	>= 3.1.0 < 3.1.21	3.1.21
oro	platform	>= 4.1.0 < 4.1.14	4.1.14
oro	platform	>= 4.2.0 < 4.2.8	4.2.8
oroinc	oroplatform	>= 3.1.0 < 3.1.21	3.1.21
oroinc	oroplatform	>= 4.1.0 < 4.1.14	4.1.14
oroinc	oroplatform	>= 4.2.0 < 4.2.8	4.2.8
oroinc	platform	—	—
oroinc	platform	—	—
oroinc	platform	—	—

CVSS provenance

nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.