Threats affecting pkg:composer/Thelia Core

Thelia versions prior to 3.2.0 contain a cross-site request forgery (CSRF) vulnerability in the back office. This vulnerability arises because per-session CSRF tokens leak via URL query strings, allowing attackers to reuse these tokens or exploit unprotected actions. Specifically, attackers can target the setToggleVisibilityAction and updatePositionAction to perform unauthorized administrative actions such as deleting, hiding, or reordering catalogue and configuration objects. The issue is fixed in Thelia versions 3.2.0 and 1.2.0.

Thelia versions prior to 3.1.0 contain a stored cross-site scripting (XSS) vulnerability in the ForSomeCustomers::getSummary() function. This flaw allows unauthenticated attackers to inject malicious scripts via unescaped customer names. When administrators view coupons related to these customers, the injected scripts execute, potentially stealing CSRF tokens and enabling attackers to create administrator accounts.