Skip to content

PrestaShop some attribute not escaped in Validate::isCleanHTML method

High severity GitHub Reviewed Published Jan 2, 2024 in PrestaShop/PrestaShop • Updated Jan 8, 2024

Package

composer prestashop/prestashop (Composer)

Affected versions

>= 8.0.0-beta.1, < 8.1.3
< 1.7.8.11

Patched versions

8.1.3
1.7.8.11

Description

Description

Some event attributes are not detected by the isCleanHTML method

Impact

Some modules using the isCleanHTML method could be vulnerable to xss

Patches

8.1.3, 1.7.8.11

Workarounds

The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.

Reporters

Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).

References

@matthieu-rolland matthieu-rolland published to PrestaShop/PrestaShop Jan 2, 2024
Published by the National Vulnerability Database Jan 2, 2024
Published to the GitHub Advisory Database Jan 3, 2024
Reviewed Jan 3, 2024
Last updated Jan 8, 2024

Severity

High
8.1
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N

Weaknesses

CVE ID

CVE-2024-21627

GHSA ID

GHSA-xgpm-q3mq-46rq

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.