PT-2024-18979 · Unknown · Prestashop

Rona Febriana · Published 2024-01-02 · Updated 2024-03-06 · CVE-2024-21628

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.3

Description PrestaShop is an open-source e-commerce platform. The issue arises because the isCleanHtml method is not used on a specific form, allowing the storage of a cross-site scripting payload in the database. The impact is low due to twig's escape mechanism, which prevents HTML interpretation in the back office (BO). However, in the front office (FO), the cross-site scripting attack can be effective but only affects the customer who sent it or the customer session from which it was sent. This issue particularly affects those with a module that fetches and displays these messages from the database without escaping HTML.

Recommendations For PrestaShop versions prior to 8.1.3, update to version 8.1.3, which contains a patch for this issue. As a temporary workaround, consider disabling any modules that fetch and display messages from the database without proper HTML escaping until the patch can be applied. Restrict access to modules that may be vulnerable to this issue to minimize the risk of exploitation. Avoid using modules that display unescaped HTML content from the database in the front office until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-PRESTASHOP-2024-21628

CVE-2024-21628

GHSA-VR7M-R9VM-M4WF

Affected Products

Prestashop

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21628.json · Exploit
• https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597 · Patch
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-vr7m-r9vm-m4wf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vr7m-r9vm-m4wf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21628 · Security Note
• https://osv.dev/vulnerability/BIT-prestashop-2024-21628 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-21628 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://github.com/PrestaShop/PrestaShop/commit/afc45b93b3cc33be0e571559d2838c6960d98856 · Note
• https://twitter.com/VulmonFeeds/status/1742329859353854067 · Twitter Post
• https://twitter.com/CVEnew/status/1742299174412955720 · Twitter Post
• https://t.me/cibsecurity/74213 · Telegram Post