GHSA-35pq-7pv2-2rfw
Suggest an improvement- Source
- https://github.com/advisories/GHSA-35pq-7pv2-2rfw
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/01/GHSA-35pq-7pv2-2rfw/GHSA-35pq-7pv2-2rfw.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/GHSA-35pq-7pv2-2rfw
- Aliases
- Published
- 2025-01-22T18:10:58Z
- Modified
- 2025-01-22T18:27:01.262381Z
- Severity
-
- 6.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H CVSS Calculator
- Summary
- ps_contactinfo has a potential XSS due to usage of the nofilter tag in template
- Details
-
Impact
This can not be exploited in a fresh install of PrestaShop, only shops made vulnerable by third party modules are concerned.
For example, if your shop has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored XSS in FO.
Patches
The long term fix is to have all your modules maintained and updated. The fix on ps_contactinfo will keep formatted addresses from displaying an xss stored in the database.
Workarounds
none
References
none
- Database specific
{ "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2025-01-22T18:10:58Z", "nvd_published_at": "2025-01-22T15:15:27Z", "severity": "MODERATE" }- References
Affected packages
Packagist / prestashop/ps_contactinfo
Package
- Name
- prestashop/ps_contactinfo
- Purl
- pkg:composer/prestashop/ps_contactinfo