Description
Potential XSS injection with contact form
Impact
An attacker is able to inject javascript while using the contact form.
Patches
The problem is fixed in v4.3.0
References
Original text by NVD (NIST), public domain.
CVSS metrics 3.1
Source: security-advisories@github.com · secondaryCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NAttack vectorNetwork
ComplexityHigh
Privileges requiredNone
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone
References
Found a vulnerability?
Write to the PrestaShop core security team:
security-core@prestashop.com