CVE-2023-39527

HIGH8.3EPSS 1.9%

PrestaShop XSS injection through Validate::isCleanHTML method

發布日:2023/8/9修改日:2024/3/6

也稱為:GHSA-xw2r-f8xv-c8xpBIT-prestashop-2023-39527

描述

### Impact xss injection through `isCleanHTML` method ### Patches 1.7.8.10 8.0.5 8.1.1 ### Found by Aleksey Solovev (Positive Technologies) ### Workarounds ### References

受影響套件(2)

Bitnami/prestashop>= 8.0.0, < 8.0.5 | >= 8.1.0, <= 8.1.0
Packagist/prestashop/prestashop>= 8.1.0, < 8.1.1

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 3.1	HIGH8.3	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:H

參考連結(4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-39527
PATCHhttps://github.com/PrestaShop/PrestaShop
WEBhttps://github.com/PrestaShop/PrestaShop/commit/afc14f8eaa058b3e6a20ac43e033ee2656fb88b4
WEBhttps://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xw2r-f8xv-c8xp