CVE-2022-35933

Опубликовано: 02 сент. 2022

Источник: nvd

CVSS3: 4.3

CVSS3: 6.1

EPSS Низкий

Описание

This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.

Ссылки

https://github.com/PrestaShop/productcomments/commit/314456d739155aa71f0b235827e8e0f24b97c26b
Patch
Third Party Advisory
https://github.com/PrestaShop/productcomments/security/advisories/GHSA-prrh-qvhf-x788
Third Party Advisory
https://github.com/PrestaShop/productcomments/commit/314456d739155aa71f0b235827e8e0f24b97c26b
Patch
Third Party Advisory
https://github.com/PrestaShop/productcomments/security/advisories/GHSA-prrh-qvhf-x788
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:prestashop:productcomments:*:*:*:*:*:prestashop:*:*

Версия до 5.0.2 (исключая)

EPSS

Процентиль: 46%

0.00234

Низкий

4.3 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-prrh-qvhf-x788

CVSS3: 4.3

github

больше 3 лет назад

PrestaShop Product Comments Cross-site Scripting vulnerability

EPSS

Процентиль: 46%

0.00234

Низкий

4.3 Medium

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79