medium6.1
CVE-2019-11876
PrestaShop Cross-site Scripting vulnerability
Impact
In PrestaShop 1.7.5.2, the `shop_country` parameter in the `install/index.php` installation `script/component` is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | prestashop/prestashop | = 1.7.5.2 | 1.7.6.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Prestashop | Prestashop | Version 1.7.5.2 |
| Drupal | Drupal | Version 8.7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://www.logicallysecure.com/blog/xss-presta-xss-drupal/
- https://www.prestashop.com/forums/forum/2-prestashop-news-and-releases/
- https://github.com/advisories/GHSA-6grv-hw8g-4gfm
- https://nvd.nist.gov/vuln/detail/CVE-2019-11876
- https://www.logicallysecure.com/blog/xss-presta-xss-drupal
- https://www.prestashop.com/forums/forum/2-prestashop-news-and-releases