CVE-2020-15178

Опубликовано: 15 сент. 2020

Источник: nvd

CVSS3: 8

CVSS3: 9.3

CVSS2: 4.3

EPSS Низкий

Описание

In PrestaShop contactform module (prestashop/contactform) before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The message field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript in a victim's browser.

Ссылки

https://github.com/PrestaShop/contactform/commit/ecd9f5d14920ec00885766a7cb41bcc5ed8bfa09
Patch
Third Party Advisory
https://github.com/PrestaShop/contactform/security/advisories/GHSA-95hx-62rh-gg96
Third Party Advisory
https://packagist.org/packages/prestashop/contactform
Vendor Advisory
https://github.com/PrestaShop/contactform/commit/ecd9f5d14920ec00885766a7cb41bcc5ed8bfa09
Patch
Third Party Advisory
https://github.com/PrestaShop/contactform/security/advisories/GHSA-95hx-62rh-gg96
Third Party Advisory
https://packagist.org/packages/prestashop/contactform
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:prestashop:contactform:*:*:*:*:*:prestashop:*:*

Версия до 4.3.0 (исключая)

EPSS

Процентиль: 68%

0.00583

Низкий

8 High

CVSS3

9.3 Critical

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-95hx-62rh-gg96

CVSS3: 8

github

больше 5 лет назад

Potential XSS injection In PrestaShop contactform

EPSS

Процентиль: 68%

0.00583

Низкий

8 High

CVSS3

9.3 Critical

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-79