CVE-2020-15162

EUVD-2020-7237
In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
GitHub_MCNA
5.4 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 47%
Affected Products (NVD)
VendorProductVersion
prestashopprestashop
1.5.0.0 ≤
𝑥
< 1.7.6.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/PrestaShop/PrestaShop/commit/2cfcd33c75974a49f17665f294f228454e14d9cf
https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-rc8c-v7rq-q392
https://github.com/PrestaShop/PrestaShop/commit/2cfcd33c75974a49f17665f294f228454e14d9cf
https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-rc8c-v7rq-q392