要点
- CVE-2024-21627 是影响 prestashop/prestashop, prestashop (prestashop) 的中危 (CVSS 6.1)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.52%，高于 44.4% 的漏洞。
- 修复：升级到 8.1.3, 1.7.8.11 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| prestashop/prestashop Packagist | ≥ 8.0.0-beta.1, < 8.1.3< 1.7.8.11
| 8.1.31.7.8.11
|
| prestashop | ≥ 8.0.0, < 8.1.3< 1.7.8.11
| 8.1.31.7.8.11
|
Description
Description
Some event attributes are not detected by the isCleanHTML method
Impact
Some modules using the isCleanHTML method could be vulnerable to xss
Patches
8.1.3, 1.7.8.11
Workarounds
The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
Reporters
Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).
NVD description
PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`.
prestashop/prestashop 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free