GHSA-6grv-hw8g-4gfm

ghsaUSosv

PrestaShop Cross-site Scripting vulnerability

view advisory published 2022-05-24Licence: CC-BY-4.0

In PrestaShop 1.7.5.2, the `shop_country` parameter in the `install/index.php` installation `script/component` is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-11876US	medium6.1	0.89% (59th)	—	2019-05-24
In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires th…

references

External citations — patches, advisories, analysis.

https://github.com/PrestaShop/PrestaShopPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2019-11876ADVISORY
https://www.logicallysecure.com/blog/xss-presta-xss-drupalWEB
https://www.prestashop.com/forums/forum/2-prestashop-news-and-releasesWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan