CVE-2024-21627CWE-20CWE-79

Some attribute not escaped in Validate::isCleanHTML method

High · published January 2, 2024

CVSS v3.1
8.1
EPSS
1%
Percentile
43.6
In the wild
Unconfirmed
What it is

PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00523 · 43.6th percentile
Weaknesses
CWE-20 · Improper Input Validation; CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-01-02T21:03Z
EPSS history
Timeline
  • 02 JAN 21:03Z
    Some attribute not escaped in Validate::isCleanHTML method
    cvelistv5