CVE-2023-39527

PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to cross-site scripting through the isCleanHTML method. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.

Published: Aug 7, 2023
Updated: May 10, 2024
CVE: CVE-2023-39527
GHSA: GHSA-xw2r-f8xv-c8xp
Severity: Medium
Exploit:

CVSS v3:

Severity: Medium
Score: 6.1
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWEs:

CWE-79
CWE-116

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
prestashop / prestashop	8.1.0	8.1.0.x
prestashop / prestashop	-	1.7.8.10
prestashop / prestashop	8.0.0	8.0.5
prestashop / prestashop	8.1.0	8.1.0.x
prestashop / prestashop	8.1.0	8.1.1
prestashop / prestashop	8.0.0	8.0.5
prestashop / prestashop	-	1.7.8.10

https://github.com/PrestaShop/PrestaShop/commit/afc14f8eaa058b3e6a20ac43e033ee2656fb88b4
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xw2r-f8xv-c8xp

Vulnerability Database

CVE-2023-39527

Deep Security Visibility Without the Complexity