Description
Potential XSS due to usage of the nofilter tag in template
Impact
This can not be exploited in a fresh install of PrestaShop, only shops made vulnerable by third party modules are concerned.
For example, if your shop has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored XSS in FO.
Patches
The long term fix is to have all your modules maintained and updated. The fix on ps_contactinfo will keep formatted addresses from displaying an xss stored in the database.
Workarounds
none
References
none
Original text by NVD (NIST), public domain.
CVSS metrics 3.1
Source: security-advisories@github.com · secondaryCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:HAttack vectorNetwork
ComplexityHigh
Privileges requiredHigh
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityLow
AvailabilityHigh
References
Found a vulnerability?
Write to the PrestaShop core security team:
security-core@prestashop.com