CVE-2024-21627

{"id": "CVE-2024-21627", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.7}]}, "published": "2024-01-02T21:15:10.467", "references": [{"url": "https://github.com/PrestaShop/PrestaShop/commit/73cfb44666818eefd501b526a894fe884dd12129", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/PrestaShop/PrestaShop/commit/ba06d18466df5b92cb841d504cc7210121104883", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xgpm-q3mq-46rq", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`."}, {"lang": "es", "value": "PrestaShop es una plataforma de comercio electr\u00f3nico de c\u00f3digo abierto. Antes de las versiones 8.1.3 y 1.7.8.11, el m\u00e9todo `isCleanHTML` no detecta algunos atributos de eventos. Algunos m\u00f3dulos que utilizan el m\u00e9todo `isCleanHTML` podr\u00edan ser vulnerables a cross site scripting. Las versiones 8.1.3 y 1.7.8.11 contienen un parche para este problema. La mejor soluci\u00f3n es utilizar la librer\u00eda `HTMLPurifier` para sanitizar la entrada HTML proveniente de los usuarios. La librer\u00eda ya est\u00e1 disponible como dependencia en el proyecto PrestaShop. Sin embargo, tenga en cuenta que en los modelos de objetos heredados, los campos de tipo `HTML` llamar\u00e1n `isCleanHTML`."}], "lastModified": "2024-01-08T19:23:49.707", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A2437874-DFE9-40D7-830C-727A225366DD", "versionEndExcluding": "1.7.8.11"}, {"criteria": "cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6D8ED724-5385-47E2-8BE2-C2588964AADA", "versionEndExcluding": "8.1.3", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}