GitHub Advisoryadvisory · Packagist

GHSA-prrh-qvhf-x788 PrestaShop Product Comments Cross-site Scripting vulnerability

MEDIUM Published 2022-08-31 Modified 2022-09-13 Official page ↗

Aliases: CVE-2022-35933
Ecosystem: Packagist
Packages: prestashop/productcomments
Severity: Moderate
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses: CWE-79
Reviewed: 2022-08-31

Affected packages

• Packagist prestashop/productcomments: < 5.0.2 → fixed in 5.0.2

Description

Impact An attacker could steal an admin's cookie Patches The issue is fixed in 5.0.2 References Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Related

Alias · CVE (1)

CVE-2022-35933 This package is a PrestaShop module that allows users to post reviews and rate products. vulnerability

Weakness · CWE (1)

CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References