CVE-2024-21628 XSS can be stored in DB from "add a message form" in order detail page (FO)

2024-01-0221:17:14

CWE-79

GitHub_M

www.cve.org

xss

prestashop

vulnerability

order detail page

database

customer session

patch

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L

0.0005 Low

EPSS

Percentile

17.1%

JSON

PrestaShop is an open-source e-commerce platform. Prior to version 8.1.3, the isCleanHtml method is not used on this this form, which makes it possible to store a cross-site scripting payload in the database. The impact is low because the HTML is not interpreted in BO, thanks to twig’s escape mechanism. In FO, the cross-site scripting attack is effective, but only impacts the customer sending it, or the customer session from which it was sent. This issue affects those who have a module fetching these messages from the DB and displaying it without escaping HTML. Version 8.1.3 contains a patch for this issue.

CNA Affected

[
  {
    "vendor": "PrestaShop",
    "product": "PrestaShop",
    "versions": [
      {
        "version": "< 8.1.3",
        "status": "affected"
      }
    ]
  }
]