ESLog inGet started free
Medium 5.4 CVSS 3.1 ps_facetedsearch Published on 2020-03-25

Reflected XSS with url_name parameter

CVECVE-2020-5277 GHSAGHSA-mmmv-m5q9-g3cm
View at the source View JSON Last modified at the source: 2026-06-17

Description

Reflected XSS with url_name parameter

Impact

Reflected XSS with url_name parameter.

Patches

The problem is fixed in 3.5.0

References

Reflected XSS on OWASP Introduce by this commit: bdc34d9c890083f3d7f1453759c00e8dbf28a75a

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security-advisories@github.com · secondary
Medium 5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vectorNetwork
ComplexityLow
Privileges requiredLow
User interactionRequired
ScopeChanged
ConfidentialityLow
IntegrityNone
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: ps_facetedsearch
All ps_facetedsearch advisories (3)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2026-54159 PHP Object Injection in faceted search cache allows unauthenticated RCE ps_facetedsearch Critical 10.0 ≥ 3.0.0 < 4.0.4 2026-07-17 Yes
GHSA-f884-gm86-cg3q Faceted search module might be vulnerable from CVE-2017-9841 ps_facetedsearch Unscored = 2.2.1
= 3.0.0 2020-01-07 Yes

Do you use the ps_facetedsearch module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected