Headline
GHSA-xgpm-q3mq-46rq: PrestaShop some attribute not escaped in Validate::isCleanHTML method
Description
Some event attributes are not detected by the isCleanHTML method
Impact
Some modules using the isCleanHTML method could be vulnerable to xss
Patches
8.1.3, 1.7.8.11
Workarounds
The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
Reporters
Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).
Package
composer prestashop/prestashop (Composer)
Affected versions
>= 8.0.0-beta.1, < 8.1.3
< 1.7.8.11
Patched versions
8.1.3
1.7.8.11
Description
Description
Some event attributes are not detected by the isCleanHTML method
Impact
Some modules using the isCleanHTML method could be vulnerable to xss
Patches
8.1.3, 1.7.8.11
Workarounds
The best workaround is to use the HTMLPurifier library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of HTML type will call isCleanHTML.
Reporters
Reported by Antonio Russo (@Antonio-R1 on GitHub) and Antonio Rocco Spataro (@antoniospataro on GitHub).
References
- GHSA-xgpm-q3mq-46rq
- https://nvd.nist.gov/vuln/detail/CVE-2024-21627
- PrestaShop/PrestaShop@0ed1af8
- PrestaShop/PrestaShop@73cfb44
- PrestaShop/PrestaShop@ba06d18
- PrestaShop/PrestaShop@f799dcf
matthieu-rolland published to PrestaShop/PrestaShop
Jan 2, 2024
Published by the National Vulnerability Database
Jan 2, 2024
Published to the GitHub Advisory Database
Jan 3, 2024
Reviewed
Jan 3, 2024