GitHub Advisoryadvisory · Packagist

GHSA-xgpm-q3mq-46rq PrestaShop some attribute not escaped in Validate::isCleanHTML method

HIGH Published 2024-01-03 Modified 2024-01-03 Official page ↗
Aliases
CVE-2024-21627
Ecosystem
Packagist
Packages
prestashop/prestashop
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-20, CWE-79
Reviewed
2024-01-03

Affected packages

• Packagist prestashop/prestashop: >= 8.0.0-beta.1, < 8.1.3 → fixed in 8.1.3 • Packagist prestashop/prestashop: < 1.7.8.11 → fixed in 1.7.8.11

Description

Description Some event attributes are not detected by the isCleanHTML method Impact Some modules using the isCleanHTML method could be vulnerable to xss Patches 8.1.3, 1.7.8.11 Workarounds The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`. Reporters Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).

Related

Alias · CVE (1)

  • CVE-2024-21627 PrestaShop is an open-source e-commerce platform. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References