GitHub Advisoryadvisory · Packagist

GHSA-mrq4-7ch7-2465 Server Side Twig Template Injection

CRITICAL Published 2022-01-27 Modified 2022-02-07 Official page ↗
Aliases
CVE-2022-21686
Ecosystem
Packagist
Packages
prestashop/prestashop
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2022-01-26

Affected packages

• Packagist prestashop/prestashop: >= 1.7.0.0, < 1.7.8.3 → fixed in 1.7.8.3

Description

PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside the back office when using the legacy layout. The problem is fixed in version 1.7.8.3. There are no known workarounds.

Related

Alias · CVE (1)

  • CVE-2022-21686 PrestaShop is an Open Source e-commerce platform. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References