Vulnerability · Published Jan 2, 2024 · Assigned by GitHub_M

CVE-2024-21628XSS can be stored in DB from "add a message form" in order detail page (FO)

Medium 5.4

In plain English

A medium-severity cross-site scripting in PrestaShop from PrestaShop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.4%top 66.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig's escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	prestashop/prestashop	8.1.3	GHSA-vr7m-r9vm-m4wf

Affected products (as reported)

Vendor	Product	Versions
PrestaShop	PrestaShop	< 8.1.3

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L

References

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-vr7m-r9vm-m4wf x_refsource_CONFIRM
https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597 x_refsource_MISC