GHSA-vr7m-r9vm-m4wf

    Dashboard / Vulnerabilities / GHSA-vr7m-r9vm-m4wf

    GHSA-vr7m-r9vm-m4wf

    Published: 3 Jan 2024Last Modified: 10 Sept 2026

    Summary: PrestaShop XSS can be stored in DB from "add a message form" in order detail page (FO)

    Details: ### Impact The isCleanHtml method is not used on this this form, which makes it possible to store an xss in DB. The impact is low because the html is not interpreted in BO, thanks to twig's escape mechanism. In FO, the xss is effective, but only impacts the customer sending it, or the customer session from which it was sent. Be careful if you have a module fetching these messages from the DB and displaying it without escaping html. ### Patches 8.1.x ### Reporter Reported by Rona Febriana (linkedin: https://www.linkedin.com/in/rona-febriana/)

    References: https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-vr7m-r9vm-m4wf, https://nvd.nist.gov/vuln/detail/CVE-2024-21628, https://github.com/PrestaShop/PrestaShop/commit/afc45b93b3cc33be0e571559d2838c6960d98856, https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597, https://github.com/PrestaShop/PrestaShop

    Affected packages

    Package

    Name: prestashop/prestashop

    Purl: pkg:composer/prestashop/prestashop

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -8.1.3

    Affected versions

    1.7.0.0
    1.7.0.0-beta.1.0
    1.7.0.0-beta.2.0
    1.7.0.0-beta.3.0
    1.7.0.0-beta.4.0
    1.7.0.0-rc.0.0
    1.7.0.0-rc.1.0
    1.7.0.0-rc.2.0
    1.7.0.1
    1.7.0.2
    1.7.0.3
    1.7.0.4
    1.7.0.5
    1.7.0.6
    1.7.1.0
    1.7.1.1
    1.7.1.2
    1.7.2.0
    1.7.2.0-rc.1.0
    1.7.2.1
    1.7.2.2
    1.7.2.3
    1.7.2.4
    1.7.2.5
    1.7.3.0
    1.7.3.1
    1.7.3.2
    1.7.3.3
    1.7.3.4
    1.7.4.0
    1.7.4.0-beta.1
    1.7.4.1
    1.7.4.2
    1.7.4.3
    1.7.4.4
    1.7.5.0
    1.7.5.0-beta.1
    1.7.5.0-rc.1
    1.7.5.1
    1.7.5.2
    1.7.6.0
    1.7.6.0-beta.1
    1.7.6.0-rc.1
    1.7.6.0-rc.2
    1.7.6.1
    1.7.6.2
    1.7.6.3
    1.7.6.4
    1.7.6.5
    1.7.6.6
    1.7.6.7
    1.7.6.8
    1.7.6.9
    1.7.7.0
    1.7.7.0-beta.1
    1.7.7.0-beta.2
    1.7.7.0-rc.1
    1.7.7.1
    1.7.7.2
    1.7.7.3
    1.7.7.4
    1.7.7.5
    1.7.7.6
    1.7.7.7
    1.7.7.8
    1.7.8.0
    1.7.8.0-beta.1
    1.7.8.0-rc.1
    1.7.8.1
    1.7.8.10
    1.7.8.11
    1.7.8.2
    1.7.8.3
    1.7.8.4
    1.7.8.5
    1.7.8.6
    1.7.8.7
    1.7.8.8
    1.7.8.9

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-vr7m-r9vm-m4wf | CVE-DB