PT-2024-18978 · Unknown · Prestashop

Antonio-R1 + 1 · Published 2024-01-02 · Updated 2024-03-06 · CVE-2024-21627

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.3 PrestaShop versions prior to 1.7.8.11

Description PrestaShop is an open-source e-commerce platform. Some event attributes are not detected by the isCleanHTML method, which could make some modules using this method vulnerable to cross-site scripting.

Recommendations For versions prior to 8.1.3, update to version 8.1.3 to resolve the issue. For versions prior to 1.7.8.11, update to version 1.7.8.11 to resolve the issue. As a temporary workaround, consider using the HTMLPurifier library to sanitize HTML input coming from users, as it is already available as a dependency in the PrestaShop project. Be aware that in legacy object models, fields of HTML type will call isCleanHTML.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

BIT-PRESTASHOP-2024-21627

CVE-2024-21627

GHSA-XGPM-Q3MQ-46RQ

Affected Products

Prestashop

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21627.json · Exploit
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xgpm-q3mq-46rq · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop/commit/73cfb44666818eefd501b526a894fe884dd12129 · Patch
• https://github.com/PrestaShop/PrestaShop/commit/ba06d18466df5b92cb841d504cc7210121104883 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-21627 · Security Note
• https://osv.dev/vulnerability/BIT-prestashop-2024-21627 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xgpm-q3mq-46rq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21627 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://github.com/PrestaShop/PrestaShop/commit/0ed1af8de500538490f88e9e794e2e8113fb8df7 · Note
• https://github.com/PrestaShop/PrestaShop/commit/f799dcff564cd1b7ead932ffc3343b675107dbce · Note
• https://t.me/cibsecurity/74204 · Telegram Post
• https://twitter.com/CVEnew/status/1742295802960121997 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1742332642601611601 · Twitter Post