GHSA-xgpm-q3mq-46rq
Suggest an improvement- Source
- https://github.com/advisories/GHSA-xgpm-q3mq-46rq
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-xgpm-q3mq-46rq/GHSA-xgpm-q3mq-46rq.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-xgpm-q3mq-46rq
- Aliases
- Published
- 2024-01-03T21:41:14Z
- Modified
- 2024-03-06T12:27:59.188330Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
- Summary
- PrestaShop some attribute not escaped in Validate::isCleanHTML method
- Details
-
Description
Some event attributes are not detected by the isCleanHTML method
Impact
Some modules using the isCleanHTML method could be vulnerable to xss
Patches
8.1.3, 1.7.8.11
Workarounds
The best workaround is to use the
HTMLPurifierlibrary to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields ofHTMLtype will callisCleanHTML.Reporters
Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).
- Database specific
{ "nvd_published_at": "2024-01-02T21:15:10Z", "github_reviewed_at": "2024-01-03T21:41:14Z", "cwe_ids": [ "CWE-20", "CWE-79" ], "severity": "HIGH", "github_reviewed": true }- References
-
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xgpm-q3mq-46rq
- https://nvd.nist.gov/vuln/detail/CVE-2024-21627
- https://github.com/PrestaShop/PrestaShop/commit/0ed1af8de500538490f88e9e794e2e8113fb8df7
- https://github.com/PrestaShop/PrestaShop/commit/73cfb44666818eefd501b526a894fe884dd12129
- https://github.com/PrestaShop/PrestaShop/commit/ba06d18466df5b92cb841d504cc7210121104883
- https://github.com/PrestaShop/PrestaShop/commit/f799dcff564cd1b7ead932ffc3343b675107dbce
- https://github.com/PrestaShop/PrestaShop
Affected packages
Packagist / prestashop/prestashop
Package
- Name
- prestashop/prestashop
- Purl
- pkg:composer/prestashop/prestashop
Packagist / prestashop/prestashop
Package
- Name
- prestashop/prestashop
- Purl
- pkg:composer/prestashop/prestashop
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1.7.8.11
Affected versions
1.*
1.7.0.0-beta.1.0
1.7.0.0-beta.2.0
1.7.0.0-beta.3.0
1.7.0.0-beta.4.0
1.7.0.0-rc.0.0
1.7.0.0-rc.1.0
1.7.0.0-rc.2.0
1.7.0.0
1.7.0.1
1.7.0.2
1.7.0.3
1.7.0.4
1.7.0.5
1.7.0.6
1.7.1.0
1.7.1.1
1.7.1.2
1.7.2.0-rc.1.0
1.7.2.0
1.7.2.1
1.7.2.2
1.7.2.3
1.7.2.4
1.7.2.5
1.7.3.0
1.7.3.1
1.7.3.2
1.7.3.3
1.7.3.4
1.7.4.0-beta.1
1.7.4.0
1.7.4.1
1.7.4.2
1.7.4.3
1.7.4.4
1.7.5.0-beta.1
1.7.5.0-rc.1
1.7.5.0
1.7.5.1
1.7.5.2
1.7.6.0-beta.1
1.7.6.0-rc.1
1.7.6.0-rc.2
1.7.6.0
1.7.6.1
1.7.6.2
1.7.6.3
1.7.6.4
1.7.6.5
1.7.6.6
1.7.6.7
1.7.6.8
1.7.6.9
1.7.7.0-beta.1
1.7.7.0-beta.2
1.7.7.0-rc.1
1.7.7.0
1.7.7.1
1.7.7.2
1.7.7.3
1.7.7.4
1.7.7.5
1.7.7.6
1.7.7.7
1.7.7.8
1.7.8.0-beta.1
1.7.8.0-rc.1
1.7.8.0
1.7.8.1
1.7.8.2
1.7.8.3
1.7.8.4
1.7.8.5
1.7.8.6
1.7.8.7
1.7.8.8
1.7.8.9
1.7.8.10