MEDIUM5.4

GHSA-5gg9-gwj4-mqmj

OrchardCore vulnerable to HTML injection

Quick fix

GHSA-5gg9-gwj4-mqmj — OrchardCore: upgrade to the fixed version with the command below.

dotnet add package OrchardCore --version 1.4.0

Details

OrchardCore versions starting with 1.0.0-rc1-11259 and prior to 1.4.0 are vulnerable to HTML injection. The vulnerability allows an authenticated user with an editor security role to inject a persistent HTML modal dialog component into the dashboard that will affect admin users. Version 1.4.0 contains a patch.

Are you affected?

Enter the version of the package you're using.

Affected packages

NuGet/OrchardCore

Introduced in: 1.0.0-rc1-11259Fixed in: 1.4.0

Fixdotnet add package OrchardCore --version 1.4.0

References

https://nvd.nist.gov/vuln/detail/CVE-2022-32173[ADVISORY]
https://github.com/OrchardCMS/OrchardCore/pull/11729[WEB]
https://github.com/OrchardCMS/OrchardCore/commit/0163c88ddeaca39815d7e6e5ea1c8391085cc136[WEB]
https://github.com/OrchardCMS/OrchardCore[PACKAGE]
https://www.mend.io/vulnerability-database/CVE-2022-32173[WEB]