Description
Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.6.1-GA.
Remediation
References
https://github.com/Contrast-Security-OSS/Burptrast/tree/main/docs/CVE-2023-33725
Related Vulnerabilities
CVE-2023-3276 Vulnerability in maven package cn.hutool:hutool-core
CVE-2023-29566 Vulnerability in npm package dawnsparks-node-tesseract
CVE-2020-7641 Vulnerability in npm package grunt-util-property
CVE-2023-34466 Vulnerability in maven package org.xwiki.platform:xwiki-platform-tag-api
CVE-2015-1833 Vulnerability in maven package org.apache.jackrabbit:jackrabbit-webdav