CVE-2022-45448CWE-79

Cross-site Scripting in M4 PDF plugin for Prestashop sites

Low · published September 20, 2023

CVSS v3.1
3.5
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pdf.php uses templates to dynamically create documents. In the case that the template does not exist, the application will return a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the parameter.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00328 · 24.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2023-09-20T12:14Z
EPSS history
Timeline
  • 20 SEP 12:14Z
    Cross-site Scripting in M4 PDF plugin for Prestashop sites
    cvelistv5