PT-2018-18101 · Prestashop · Prestashop

Arif Khan + 1 · Published 2018-02-26 · Updated 2020-08-24 · CVE-2018-7491

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.2.5

Description A UI-Redressing/Clickjacking issue was discovered, potentially leading to state-changing impact in the context of a user or an admin. This is because the generateHtaccess function in classes/Tools.php does not set X-Frame-Options or 'Content-Security-Policy "frame-ancestors" values.

Recommendations For PrestaShop versions prior to 1.7.2.5, consider setting X-Frame-Options and 'Content-Security-Policy "frame-ancestors" values manually to mitigate the risk of UI-Redressing/Clickjacking attacks. As a temporary workaround, restrict access to the generateHtaccess function in classes/Tools.php until a patch is available.

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2018-7491

Affected Products

Prestashop

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-7491 · Security Note
• http://forge.prestashop.com/browse/BOOM-4917 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-7491 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop/pull/8807 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7491 · Note