Server Side Twig Template Injection

2022-01-2718:32:47

Google

osv.dev

prestashop

open source

e-commerce

platform

version 1.7.0.0

version 1.7.8.3

attacker

inject

twig code

legacy layout

back office

fixed

EPSS

0.003

Percentile

71.9%

JSON

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.