PT-2020-14250 · Prestashop · Prestashop Contactform Module

Pierre Rambaud · Published 2020-09-15 · Updated 2020-09-21 · CVE-2020-15178

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop contactform module versions prior to 4.3.0

Description The issue allows an attacker to inject JavaScript while using the contact form, potentially executing arbitrary JavaScript in a victim's browser. This is due to the message field being incorrectly unescaped.

Recommendations For PrestaShop contactform module versions prior to 4.3.0, update to version 4.3.0 to resolve the issue. As a temporary workaround, consider restricting the use of the contact form until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-15178

GHSA-95HX-62RH-GG96

Affected Products

Prestashop Contactform Module

References · 8

• https://github.com/PrestaShop/contactform/commit/ecd9f5d14920ec00885766a7cb41bcc5ed8bfa09 · Patch
• https://packagist.org/packages/prestashop/contactform · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15178 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-95hx-62rh-gg96 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15178 · Security Note
• https://github.com/PrestaShop/contactform/commit/a1da814bea7e5750b858a2dbbc58ace80379f42f · Note
• https://github.com/PrestaShop/contactform/security/advisories/GHSA-95hx-62rh-gg96 · Note
• https://github.com/PrestaShop/contactform · Note