GHSA-35pq-7pv2-2rfw
ps_contactinfo has a potential XSS due to usage of the nofilter tag in template
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | prestashop/ps_contactinfo | < 3.3.3 | 3.3.3 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
This can not be exploited in a fresh install of PrestaShop, only shops made vulnerable by third party modules are concerned.
For example, if your shop has a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored XSS in FO.
### Patches
The long term fix is to have all your modules maintained and updated.
The fix on ps_contactinfo will keep formatted addresses from displaying an xss stored in the database.
### Workarounds
none
### References
none
References
External links from the advisory. They lead to third-party sites.