CVE-2022-35933

    Dashboard / Vulnerabilities / CVE-2022-35933

    CVE-2022-35933

    Published: 2 Sept 2022Last Modified: 12 Aug 2026

    Summary: PrestaShop module Product Comments vulnerable to cross-site scripting (XSS)

    Details: This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35933.json, https://github.com/PrestaShop/productcomments/security/advisories/GHSA-prrh-qvhf-x788, https://nvd.nist.gov/vuln/detail/CVE-2022-35933, https://github.com/PrestaShop/productcomments/commit/314456d739155aa71f0b235827e8e0f24b97c26b

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -e1b9d0333dc186c6e3f1b721d5feeef13e450ef8

    Affected versions

    v5.0.1
    v5.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-35933 | CVE-DB