Description

In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.

Remediation

References

CVE-2020-15162

Related Vulnerabilities

WordPress Plugin WP Easy Slideshow Multiple Cross-Site Request Forgery Vulnerabilities (1.0.3)

WordPress Plugin MailPoet Newsletters (Previous) Cross-Site Scripting (2.6.11)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Local File Inclusion (1.3.64)

PHP Use of Externally-Controlled Format String Vulnerability (CVE-2011-1153)

Microsoft SQL Server CVE-2023-29356 Vulnerability (CVE-2023-29356)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2020-15162