Eternoendless

**Name of the Vulnerable Software and Affected Versions** PrestaShop versions prior to 1.7.2.5 **Description** A UI-Redressing/Clickjacking issue was discovered, potentially leading to state-changing impact in the context of a user or an admin. This is because the generateHtaccess function in classes/Tools.php does not set X-Frame-Options or 'Content-Security-Policy "frame-ancestors" values. **Recommendations** For PrestaShop versions prior to 1.7.2.5, consider setting X-Frame-Options and 'Content-Security-Policy "frame-ancestors" values manually to mitigate the risk of UI-Redressing/Clickjacking attacks. As a temporary workaround, restrict access to the generateHtaccess function in classes/Tools.php until a patch is available.