CVE-2020-15162

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-15162

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15162.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-15162

Aliases

GHSA-rc8c-v7rq-q392

Published

2020-09-24T23:15:13.807Z

Modified

2026-07-09T00:22:23.685133Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.

References

Affected packages

Git / github.com/prestashop/prestashop

Affected ranges

Type

GIT

Repo

https://github.com/prestashop/prestashop

Events

Introduced

442a0d6100d8a4177ada6086e98d2b35accbfbf3

Fixed

69f840d7f626769431c9c0ae9ad8ef1a327571c0

Fixed

2cfcd33c75974a49f17665f294f228454e14d9cf

Database specific

{
    "cpe": "cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.5.0.0"
        },
        {
            "fixed": "1.7.6.8"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15162.json"