CVE-2024-21628: XSS can be stored in DB from "add a message form" in order detail page (FO)
First published: Tue Jan 02 2024(Updated: )
### Impact The isCleanHtml method is not used on this this form, which makes it possible to store an xss in DB. The impact is low because the html is not interpreted in BO, thanks to twig's escape mechanism. In FO, the xss is effective, but only impacts the customer sending it, or the customer session from which it was sent. Be careful if you have a module fetching these messages from the DB and displaying it without escaping html. ### Patches 8.1.x ### Reporter Reported by Rona Febriana (linkedin: https://www.linkedin.com/in/rona-febriana/)
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/prestashop/prestashop | <8.1.3 | 8.1.3 |
| Prestashop | <8.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-vr7m-r9vm-m4wf
- https://nvd.nist.gov/vuln/detail/CVE-2024-21628
- https://github.com/PrestaShop/PrestaShop/commit/afc45b93b3cc33be0e571559d2838c6960d98856
- https://github.com/PrestaShop/PrestaShop/commit/c3d78b7e49f5fe49a9d07725c3174d005deaa597
- https://github.com/advisories/GHSA-vr7m-r9vm-m4wf (Advisory)
Frequently Asked Questions
What is the severity of CVE-2024-21628?
The severity of CVE-2024-21628 is considered low due to the HTML being escaped by Twig's mechanism.
How do I fix CVE-2024-21628?
To fix CVE-2024-21628, upgrade to a version of PrestaShop that is beyond 8.1.3.
What systems are affected by CVE-2024-21628?
CVE-2024-21628 affects PrestaShop versions up to and including 8.1.3.
What type of vulnerability is CVE-2024-21628?
CVE-2024-21628 is an XSS (Cross-Site Scripting) vulnerability that could allow for potential data exposure.
Can CVE-2024-21628 be exploited in the back office?
No, CVE-2024-21628 cannot be exploited in the back office because HTML is not interpreted due to Twig's escape mechanism.
- collector/github-advisory-latest
- alias/GHSA-vr7m-r9vm-m4wf
- alias/CVE-2024-21628
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/title
- agent/weakness
- agent/references
- agent/softwarecombine
- collector/github-advisory
- source/GitHub
- agent/software-canonical-lookup
- agent/event
- agent/description
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- agent/source
- agent/author
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-api
- package-manager/composer
- vendor/prestashop
- canonical/prestashop