CVE-2023-39527

HIGH8.3EPSS 1.9%

PrestaShop XSS injection through Validate::isCleanHTML method

Published: 8/9/2023Modified: 3/6/2024

Also known as:GHSA-xw2r-f8xv-c8xpBIT-prestashop-2023-39527

Description

### Impact xss injection through `isCleanHTML` method ### Patches 1.7.8.10 8.0.5 8.1.1 ### Found by Aleksey Solovev (Positive Technologies) ### Workarounds ### References

Affected packages (2)

Bitnami/prestashop>= 8.0.0, < 8.0.5 | >= 8.1.0, <= 8.1.0
Packagist/prestashop/prestashop>= 8.1.0, < 8.1.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.3	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-39527
PATCHhttps://github.com/PrestaShop/PrestaShop
WEBhttps://github.com/PrestaShop/PrestaShop/commit/afc14f8eaa058b3e6a20ac43e033ee2656fb88b4
WEBhttps://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xw2r-f8xv-c8xp