ESLog inGet started free
High 8.1 CVSS 3.1 Core Component: back office Published on 2024-01-02

Some attribute not escaped in Validate::isCleanHTML method

CVECVE-2024-21627 GHSAGHSA-xgpm-q3mq-46rq
View at the source View JSON Last modified at the source: 2026-06-17

Description

Some attribute not escaped in Validate::isCleanHTML method

Description

Some event attributes are not detected by the isCleanHTML method

Impact

Some modules using the isCleanHTML method could be vulnerable to xss

Patches

8.1.3, 1.7.8.11

Workarounds

The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.

Reporters

Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: security-advisories@github.com · secondary
High 8.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Attack vectorNetwork
ComplexityLow
Privileges requiredHigh
User interactionRequired
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityNone

References

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same component: PrestaShop core
All core advisories (94)
IDAdvisoryComponentSeverityAffected versionsPublishedFix
CVE-2026-84186 Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows… Core Medium 6.9 ≥ 8.0.0 < 8.2.8
≥ 9.0.0 < 9.1.5 2026-09-07 No
GHSA-jf3w-9rmr-5rcr Improper access control on the back-office notifications endpoint exposes customer data Core Medium 4.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
GHSA-whxq-pxj5-qq7v SQL injection through back-office list filters Core Medium 6.5 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes
GHSA-2cr4-vw9p-pjvf Client IP address can be spoofed through the X-Forwarded-For header Core High 7.3 ≥ 9.0.0 < 9.1.5
≥ 8.0.0 < 8.2.8 2026-08-18 Yes

Is your shop on 1.7.x < 1.7.8.11, 8.x ≥ 8.0.0 < 8.1.3?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.
Check if my shop is affected