CVE-2023-33725

MediumCVSS 6.1

Published: 21/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 19/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.44%

35th percentile - higher than 35% of all known CVEs

Summary

Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was found to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This issue is fixed in version 6.2.6.1-GA.

Risk Assessment

This vulnerability could allow attackers to execute malicious code in the user's browser context, potentially leading to data theft or session hijacking.

Recommendation

It is recommended to upgrade to version 6.2.6.1-GA or later to mitigate this vulnerability.

Original NVD description (English source)

Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.6.1-GA.