CVE-2024-34716
PrestaShop vulnerable to XSS via customer contact form in FO, through file upload
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
3Exploited in Wild
-Decision
Descriptions
PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag.
PrestaShop es una aplicación web de comercio electrónico de código abierto. Una vulnerabilidad de Cross Site Scripting (XSS) que solo afecta a PrestaShops con el indicador de función de hilo de cliente habilitado está presente a partir de PrestaShop 8.1.0 y antes de PrestaShop 8.1.6. Cuando el indicador de función del hilo del cliente está habilitado a través del formulario de contacto del front-office, un pirata informático puede cargar un archivo malicioso que contenga un XSS que se ejecutará cuando un administrador abra el archivo adjunto en el back-office. El script inyectado puede acceder a la sesión y al token de seguridad, lo que le permite realizar cualquier acción autenticada en el ámbito del derecho de administrador. Esta vulnerabilidad está parcheada en 8.1.6. Una workaround es desactivar el indicador de función del hilo del cliente.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-05-07 CVE Reserved
- 2024-05-14 CVE Published
- 2024-05-15 EPSS Updated
- 2024-05-15 First Exploit
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6 | X_refsource_misc | |
| https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78 | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| https://github.com/aelmokhtar/CVE-2024-34716_PoC | 2024-05-15 | |
| https://github.com/aelmokhtar/CVE-2024-34716 | 2024-09-22 | |
| https://github.com/TanveerS1ngh/Prestashop-CVE-2024-34716 | 2024-10-28 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| PrestaShop Search vendor "PrestaShop" | PrestaShop Search vendor "PrestaShop" for product "PrestaShop" | >= 8.1.0 < 8.1.6 Search vendor "PrestaShop" for product "PrestaShop" and version " >= 8.1.0 < 8.1.6" | en |
Affected
| ||||||