GitHub Advisoryadvisory · Packagist

GHSA-6grv-hw8g-4gfm PrestaShop Cross-site Scripting vulnerability

MEDIUM Published 2022-05-24 Modified 2024-04-23 Official page ↗
Aliases
CVE-2019-11876
Ecosystem
Packagist
Packages
prestashop/prestashop
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2024-04-23

Affected packages

• Packagist prestashop/prestashop: >= 1.7.5.2, < 1.7.6.0 → fixed in 1.7.6.0

Description

In PrestaShop 1.7.5.2, the `shop_country` parameter in the `install/index.php` installation `script/component` is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link.

Related

Alias · CVE (1)

  • CVE-2019-11876 In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References