Cross-Site Scripting (XSS)

2024-05-1507:06:29

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

prestashop

xss

vulnerability

customer thread

malicious file uploads

front-office

back-office

javascript

session leakage

security token leakage

CVSS3

9.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

Percentile

9.0%

JSON

prestashop/prestashop is vulnerable to Cross-Site Scripting (XSS). The vulnerability is due to the customer thread feature allowing malicious file uploads through the front-office contact form. When an admin opens the attached file in back office, arbitrary JavaScript will be executed which can result in session or security token leakage.