PT-2020-14171 · Prestashop · Prestashop

Komradz + 1 · Published 2020-07-02 · Updated 2020-07-02 · CVE-2020-15083

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.7.0.0 through 1.7.6.5

Description The issue allows for a reflected XSS attack when a corrupted file is sent to the target. This can lead to malicious script execution. The problem is fixed in version 1.7.6.6.

Recommendations For PrestaShop versions 1.7.0.0 through 1.7.6.5, update to version 1.7.6.6 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15083

GHSA-QGH4-95J7-P3VJ

Affected Products

Prestashop

References · 5

• https://github.com/PrestaShop/PrestaShop/commit/bac749bf75a4e0d6312a70b37eb5b0a556f08fbd · Patch
• https://osv.dev/vulnerability/CVE-2020-15083 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15083 · Security Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-qgh4-95j7-p3vj · Note
• https://t.me/cvenotify/4837 · Telegram Post