GHSA-xw2r-f8xv-c8xp

ghsaUSosv

PrestaShop XSS injection through Validate::isCleanHTML method

view advisory published 2023-08-09Licence: CC-BY-4.0

### Impact xss injection through `isCleanHTML` method ### Patches 1.7.8.10 8.0.5 8.1.1 ### Found by Aleksey Solovev (Positive Technologies) ### Workarounds ### References

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-39527US	medium6.1	0.51% (44th)	—	2023-08-07
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the `isCleanHTML` method. Versi…

references

External citations — patches, advisories, analysis.

https://github.com/PrestaShop/PrestaShopPACKAGE
https://github.com/PrestaShop/PrestaShop/commit/afc14f8eaa058b3e6a20ac43e033ee2656fb88b4WEB
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xw2r-f8xv-c8xpWEB
https://nvd.nist.gov/vuln/detail/CVE-2023-39527ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan