CVE-2024-21627
HIGH8.1EPSS 0.95%PrestaShop some attribute not escaped in Validate::isCleanHTML method
發布日:2024/1/3修改日:2024/3/6
描述
### Description Some event attributes are not detected by the isCleanHTML method ### Impact Some modules using the isCleanHTML method could be vulnerable to xss ### Patches 8.1.3, 1.7.8.11 ### Workarounds The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`. ### Reporters Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).
受影響套件(2)
- Bitnami/prestashop>= 8.0.0, < 8.1.3
- Packagist/prestashop/prestashop>= 8.0.0-beta.1, < 8.1.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.1 | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N |
參考連結(7)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-21627
- PATCHhttps://github.com/PrestaShop/PrestaShop
- WEBhttps://github.com/PrestaShop/PrestaShop/commit/0ed1af8de500538490f88e9e794e2e8113fb8df7
- WEBhttps://github.com/PrestaShop/PrestaShop/commit/73cfb44666818eefd501b526a894fe884dd12129
- WEBhttps://github.com/PrestaShop/PrestaShop/commit/ba06d18466df5b92cb841d504cc7210121104883
- WEBhttps://github.com/PrestaShop/PrestaShop/commit/f799dcff564cd1b7ead932ffc3343b675107dbce
- WEBhttps://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xgpm-q3mq-46rq