CVE-2022-31037 OroCommerce vulnerable to Cross-site Scripting via Shipping rule editing page

Medium 6.9 Published 18 Oct 2022 Updated 23 Apr 2025

An attacker with shipping rule editing permissions can inject malicious scripts via the UPS Surcharge field, potentially compromising user sessions.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-31037?

CVE-2022-31037 is a medium-severity cross-site scripting vulnerability in oroinc orocommerce, published on 18 Oct 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

OroCommerce is an open-source Business to Business Commerce application. Versions between 4.1.0 and 4.1.17 inclusive, 4.2.0 and 4.2.11 inclusive, and between 5.0.0 and 5.0.3 inclusive, are vulnerable to Cross-site Scripting in the UPS Surcharge field of the Shipping rule edit page. The attacker needs permission to create or edit a shipping rule. This issue has been patched in version 5.0.6. There are no known workarounds.

Weakness: CWE-79

Which versions are affected by CVE-2022-31037?

2 open source packages ship an affected version, including oro/commerce. It affects 1 product.

Package	Affected	Fixed in
`oro/commerce` Packagist	From `4.1.0`	`5.0.6`
`oro/commerce` Packagist	From `4.1.0`	`5.0.6`

Products include Oroinc Orocommerce.

How do I fix CVE-2022-31037?

Upgrade oro/commerce to 5.0.6 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2022-31037 being exploited?

There is no known exploitation of CVE-2022-31037 in the wild and no public exploit code.

Sources

Also known as GHSA-4vf4-955g-vxp2.