GHSA-35pf-37c6-jxjv
PrestaShop has multiple stored XSS vulnerabilities via unprotected Template variables
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | prestashop/prestashop | >= 9.0.0-alpha.1, < 9.1.0 | 9.1.0 |
| Packagist | prestashop/prestashop | < 8.2.5 | 8.2.5 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Multiple stored Cross-Site Scripting (stored XSS) vulnerabilities in the BO: an attacker who can inject data into the database, via limited back-office access or a previously existing vulnerability, can exploit unprotected variables in back-office templates.
### Patches
Patched on 8.2.5 and 9.1.0
### Workarounds
None
### References
None
References
External links from the advisory. They lead to third-party sites.