PT-2011-4979 · Prestashop · Prestashop

Publicado

2011-12-01

·

Atualizado

2011-12-13

·

CVE-2011-4544

CVSS v2.0

4.3

Média

VetorAV:N/AC:M/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions Prestashop versions prior to 1.5
Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via various parameters to different API endpoints, including:
  • address or relativ base dir parameter to "modules/mondialrelay/googlemap.php"
  • relativ base dir, Pays, Ville, CP, Poids, Action, or num parameter to "prestashop/modules/mondialrelay/googlemap.php"
  • num mode parameter to "modules/mondialrelay/kit mondialrelay/RechercheDetailPointRelais ajax.php"
  • Expedition parameter to "modules/mondialrelay/kit mondialrelay/SuiviExpedition ajax.php"
  • folder or name parameter to "admin/ajaxfilemanager/ajax save text.php" No information is provided about the estimated number of potentially affected devices or real-world incidents.
Recommendations For Prestashop versions prior to 1.5, update to version 1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable API endpoints until a patch is available. Avoid using the vulnerable parameters, such as address, relativ base dir, Pays, Ville, CP, Poids, Action, num, num mode, Expedition, folder, and name, in the affected API endpoints until the issue is resolved.

Exploit

Correção

XSS

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2011-4544

Produtos afetados

Prestashop