CVE-2024-37297

5.4 · MEDIUM

Published Jun 12, 2024 woocommerce CWE-79 EPSS 0.48% (40th pctl) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Overview

CVE-2024-37297 is a medium-severity vulnerability affecting woocommerce woocommerce. It was published on June 12, 2024 and has a CVSS 3.1 base score of 5.4 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 5.4, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

Technical Description

WooCommerce is an open-source e-commerce platform built on WordPress. A vulnerability introduced in WooCommerce 8.8 allows for cross-site scripting. A bad actor can manipulate a link to include malicious HTML & JavaScript content. While the content is not saved to the database, the links may be sent to victims for malicious purposes. The injected JavaScript could hijack content & data stored in the browser, including the session. The URL content is read through the `Sourcebuster.js` library and then inserted without proper sanitization to the classic checkout and registration forms. Versions 8.8.5 and 8.9.3 contain a patch for the issue. As a workaround, one may disable the Order Attribution feature.

Remediation

Check the references section for vendor advisories and patches from woocommerce. Update woocommerce to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
woocommerce	woocommerce	>= 8.8, < 8.8.5	Affected

References

Ref developer.woocommerce.com/2024/06/10/developer-advisory-xss-vulnerability-8-8-0 GitHub github.com/woocommerce/woocommerce/commit/0e9888305d0cb9557e58f558526ab11cb3bcc4b4 GitHub github.com/woocommerce/woocommerce/commit/915e32a42762916b745a7e663c8b69a698da8b67 GitHub github.com/woocommerce/woocommerce/security/advisories/GHSA-cv23-q6gh-xfrf Ref developer.woocommerce.com/2024/06/10/developer-advisory-xss-vulnerability-8-8-0 GitHub github.com/woocommerce/woocommerce/commit/0e9888305d0cb9557e58f558526ab11cb3bcc4b4 GitHub github.com/woocommerce/woocommerce/commit/915e32a42762916b745a7e663c8b69a698da8b67 GitHub github.com/woocommerce/woocommerce/security/advisories/GHSA-cv23-q6gh-xfrf

Frequently Asked Questions

What is CVE-2024-37297?

CVE-2024-37297 is a medium-severity vulnerability affecting woocommerce woocommerce. It was published on June 12, 2024 and has a CVSS 3.1 base score of 5.4 (MEDIUM).

How severe is CVE-2024-37297?

This vulnerability has a CVSS 3.1 base score of 5.4, rated MEDIUM. It can be exploited remotely over the network. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2024-37297?

How can CyberStrike help with CVE-2024-37297?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-37297 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719