PT-2022-23039 · Unknown · Prestashop

Atomiix · Published 2022-08-31 · Updated 2022-09-08 · CVE-2022-35933

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop module versions prior to 5.0.2

Description The issue allows an attacker to steal an administrator's cookie, potentially leading to unauthorized access. The problem is related to improper neutralization of input during web page generation, which can facilitate cross-site scripting attacks.

Recommendations For versions prior to 5.0.2, update to version 5.0.2 to resolve the issue. As a temporary workaround, consider restricting access to administrator accounts until the update can be applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-35933

GHSA-PRRH-QVHF-X788

Affected Products

Prestashop

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35933.json · Exploit
• https://github.com/PrestaShop/productcomments/commit/314456d739155aa71f0b235827e8e0f24b97c26b · Patch
• https://osv.dev/vulnerability/CVE-2022-35933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35933 · Security Note
• https://osv.dev/vulnerability/GHSA-prrh-qvhf-x788 · Vendor Advisory
• https://github.com/PrestaShop/productcomments/security/advisories/GHSA-prrh-qvhf-x788 · Note
• https://github.com/PrestaShop/productcomments · Note