CVE-2023-33725

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-21 · updated 2026-06-17
Weakness: CWE-79

Description

Broadleaf 5.x and 6.x (including 5.2.25-GA and 6.2.6-GA) was discovered to contain a cross-site scripting (XSS) vulnerability via a customer signup with a crafted email address. This is fixed in 6.2.6.1-GA.

Affected products

Broadleafcommerce Broadleaf Commerce: from 5.0 through 5.2.25-ga; from 6.0 before 6.2.6.1-ga — fixed in 6.2.6.1-ga

How to fix

Upgrade to a fixed version: Broadleafcommerce Broadleaf Commerce 6.2.6.1-ga. Check the vendor advisory for mitigations.

References

https://github.com/Contrast-Security-OSS/Burptrast/tree/main/docs/CVE-2023-33725
https://github.com/Contrast-Security-OSS/Burptrast/tree/main/docs/CVE-2023-33725

Get alerted when CVE-2023-33725 or the next vulnerability affects your stack