PrestaShop Product Comments Cross-site Scripting vulnerability

MITTEL 6.1CVE-2022-35933 · GHSA-prrh-qvhf-x788 · Published 02/09/2022 · updated 17/06/2026

Kurz gesagt

CVE-2022-35933 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in prestashop/productcomments, productcomments (prestashop).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.56%, höher als bei 46.7% aller Schwachstellen.
Abhilfe: auf 5.0.2 oder neuer aktualisieren.

Package	Affected versions	Patched versions
prestashop/productcomments Packagist	`< 5.0.2`	`5.0.2`
productcomments prestashop	`< 5.0.2`	`5.0.2`

Description

Impact

An attacker could steal an admin's cookie

Patches

The issue is fixed in 5.0.2

References

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

NVD description

This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.

References

PrestaShop/productcomments security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-35933 · ADVISORY
PrestaShop/productcomments commit 314456d · WEB
PrestaShop/productcomments · PACKAGE

Weitere Schwachstellen in prestashop/productcomments

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

prestashop/productcomments

Packagist

< 5.0.2

5.0.2

productcomments

prestashop

< 5.0.2

5.0.2

Description

NVD description

Weitere Schwachstellen in prestashop/productcomments

Alle anzeigen →