CVEvulnerability
CVE-2020-15162
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2020-09-24
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- CVSS 3.1 ([email protected])
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.
Affected configurations
• prestashop prestashop (>= 1.5.0.0 < 1.7.6.8)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/PrestaShop/PrestaShop/commit/2cfcd33c75974a49f17665f294f228454e14d9cf Patch, Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8 Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-rc8c-v7rq-q392 Exploit, Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/commit/2cfcd33c75974a49f17665f294f228454e14d9cf Patch, Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8 Third Party Advisory
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-rc8c-v7rq-q392 Exploit, Third Party Advisory