PrestaShop Product Comments Cross-site Scripting vulnerability

MOYENNE 6.1CVE-2022-35933 · GHSA-prrh-qvhf-x788 · Published 02/09/2022 · updated 17/06/2026

En bref

CVE-2022-35933 est une vulnérabilité MOYENNE (CVSS 6.1) touchant prestashop/productcomments, productcomments (prestashop).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.56%, plus élevée que 46.7% des vulnérabilités.
Correctif : mettre à jour vers 5.0.2 ou plus récent.

Package	Affected versions	Patched versions
prestashop/productcomments Packagist	`< 5.0.2`	`5.0.2`
productcomments prestashop	`< 5.0.2`	`5.0.2`

Description

Impact

An attacker could steal an admin's cookie

Patches

The issue is fixed in 5.0.2

References

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

NVD description

This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.

References

PrestaShop/productcomments security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-35933 · ADVISORY
PrestaShop/productcomments commit 314456d · WEB
PrestaShop/productcomments · PACKAGE

Autres vulnérabilités de prestashop/productcomments

Tout voir →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

prestashop/productcomments

Packagist

< 5.0.2

5.0.2

productcomments

prestashop

< 5.0.2

5.0.2

Description

NVD description

Autres vulnérabilités de prestashop/productcomments

Tout voir →