PT-2018-18101 · Prestashop · Prestashop

Arif Khan + 1 · Publicado 2018-02-26 · Atualizado 2020-08-24 · CVE-2018-7491

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.2.5

Description A UI-Redressing/Clickjacking issue was discovered, potentially leading to state-changing impact in the context of a user or an admin. This is because the generateHtaccess function in classes/Tools.php does not set X-Frame-Options or 'Content-Security-Policy "frame-ancestors" values.

Recommendations For PrestaShop versions prior to 1.7.2.5, consider setting X-Frame-Options and 'Content-Security-Policy "frame-ancestors" values manually to mitigate the risk of UI-Redressing/Clickjacking attacks. As a temporary workaround, restrict access to the generateHtaccess function in classes/Tools.php until a patch is available.

Correção

Clickjacking

Enumeração de Fraquezas

CWE-1021

Identificadores relacionados

CVE-2018-7491

Produtos afetados

Prestashop

Referências · 5

• https://github.com/PrestaShop/PrestaShop/pull/8807 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7491 · Nota de Segurança
• http://forge.prestashop.com/browse/BOOM-4917 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7491 · Nota
• https://osv.dev/vulnerability/CVE-2018-7491 · Aviso do Fabricante