Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/23825?format=api",
    "purl": "pkg:pypi/shuup@2.3.0",
    "type": "pypi",
    "namespace": "",
    "name": "shuup",
    "version": "2.3.0",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": true,
    "next_non_vulnerable_version": "2.11.0",
    "latest_non_vulnerable_version": "2.11.0",
    "affected_by_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/35879?format=api",
            "vulnerability_id": "VCID-1zq8-46ku-w7e9",
            "summary": "In Shuup, versions 1.6.0 through 2.10.8 are vulnerable to reflected Cross-Site Scripting (XSS) that allows execution of arbitrary javascript code on a victim browser. This vulnerability exists due to the error page contents not escaped.",
            "references": [
                {
                    "reference_url": "https://github.com/advisories/GHSA-5pcx-vqjp-p34w",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-5pcx-vqjp-p34w"
                },
                {
                    "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/shuup/PYSEC-2021-350.yaml",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/pypa/advisory-database/tree/main/vulns/shuup/PYSEC-2021-350.yaml"
                },
                {
                    "reference_url": "https://github.com/shuup/shuup",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/shuup/shuup"
                },
                {
                    "reference_url": "https://github.com/shuup/shuup/commit/75714c37e32796eb7cbb0d977af5bcaa26573588",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/shuup/shuup/commit/75714c37e32796eb7cbb0d977af5bcaa26573588"
                },
                {
                    "reference_url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25963",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25963"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25963",
                    "reference_id": "CVE-2021-25963",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25963"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/23871?format=api",
                    "purl": "pkg:pypi/shuup@2.11.0",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/shuup@2.11.0"
                }
            ],
            "aliases": [
                "CVE-2021-25963",
                "GHSA-5pcx-vqjp-p34w",
                "PYSEC-2021-350"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-1zq8-46ku-w7e9"
        },
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/35878?format=api",
            "vulnerability_id": "VCID-6jj3-28q6-6qfq",
            "summary": "“Shuup” application in versions 0.4.2 to 2.10.8 is affected by the “Formula Injection” vulnerability. A customer can inject payloads in the name input field in the billing address while buying a product. When a store administrator accesses the reports page to export the data as an Excel file and opens it, the payload gets executed.",
            "references": [
                {
                    "reference_url": "https://github.com/advisories/GHSA-663j-rjcr-789f",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-663j-rjcr-789f"
                },
                {
                    "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/shuup/PYSEC-2021-355.yaml",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/pypa/advisory-database/tree/main/vulns/shuup/PYSEC-2021-355.yaml"
                },
                {
                    "reference_url": "https://github.com/shuup/shuup",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/shuup/shuup"
                },
                {
                    "reference_url": "https://github.com/shuup/shuup/commit/0a2db392e8518410c282412561461cd8797eea51",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/shuup/shuup/commit/0a2db392e8518410c282412561461cd8797eea51"
                },
                {
                    "reference_url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25962",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25962"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25962",
                    "reference_id": "CVE-2021-25962",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25962"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/23871?format=api",
                    "purl": "pkg:pypi/shuup@2.11.0",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/shuup@2.11.0"
                }
            ],
            "aliases": [
                "CVE-2021-25962",
                "GHSA-663j-rjcr-789f",
                "PYSEC-2021-355"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-6jj3-28q6-6qfq"
        }
    ],
    "fixing_vulnerabilities": [],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/shuup@2.3.0"
}