CVE-2022-31037: 
PHP vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was discovered in OroCommerce versions between 4.1.0 and 4.1.17, 4.2.0 and 4.2.11, and 5.0.0 and 5.0.3. The vulnerability exists in the UPS Surcharge field during shipping rule editing (GHSA Advisory, NVD).

The vulnerability allows for Cross-site Scripting attacks through the UPS Surcharge field in the shipping rule edit page. The issue has a CVSS v3.1 base score of 6.9 (Moderate severity) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N. This indicates network attack vector, low attack complexity, high privileges required, user interaction required, changed scope, high confidentiality impact, low integrity impact, and no availability impact (GHSA Advisory).

The vulnerability could allow an attacker with permissions to create or edit shipping rules to execute malicious scripts through the UPS Surcharge field, potentially compromising data confidentiality and integrity (GHSA Advisory).

The vulnerability has been patched in version 5.0.6. Users are advised to upgrade to this version or later to address the security issue (GHSA Advisory).