{"id":"GHSA-p4g7-wjhq-9r2h","aliases":["CVE-2017-6099"],"title":"PayPal PHP Merchant SDK Cross-site scripting (XSS) vulnerability","description":"Cross-site scripting (XSS) vulnerability in GetAuthDetails.html.php in PayPal PHP Merchant SDK (aka merchant-sdk-php) 3.9.1 allows remote attackers to inject arbitrary web script or HTML via the token parameter.","severity":"medium","score":6.1,"published":"2022-05-14T01:21:17.000Z","modified":"2024-04-25T21:57:34.970Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"paypal/merchant-sdk-php","ranges":[{"events":[{"introduced":"3.0.0"},{"fixed":"3.12.0"}],"type":"ECOSYSTEM"}],"versions":["v3.10.0","v3.11.0","v3.4.102","v3.5.103","v3.6.106","v3.8.106","v3.8.107","v3.9.0","v3.9.1"],"fixed":["3.12.0"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2017-6099","https://github.com/paypal/merchant-sdk-php/issues/129","https://github.com/FriendsOfPHP/security-advisories/blob/master/paypal/merchant-sdk-php/CVE-2017-6099.yaml","http://www.securityfocus.com/bid/96432"],"sources":[{"name":"OSV","id":"GHSA-p4g7-wjhq-9r2h","modified":"2024-04-25T21:57:34.970702Z","url":"https://osv.dev/vulnerability/GHSA-p4g7-wjhq-9r2h"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}]}