GHSA-prrh-qvhf-x788medium4.3
PrestaShop Product Comments Cross-site Scripting vulnerability
Impact
An attacker could steal an admin's cookie
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
prestashop/productcomments Packagist
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 5.0.2Ecosystem versions | 5.0.2 |
Version evidence: OSV · GHSA-prrh-qvhf-x788
View original version evidence (10 explicit versions)
Original source description
Impact
An attacker could steal an admin's cookie
Patches
The issue is fixed in 5.0.2
References
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- Security advisory github.com/PrestaShop/productcomments/security/advisories/GHSA-prrh-qvhf-x788
- Security advisory nvd.nist.gov/vuln/detail/CVE-2022-35933
- Patch github.com/PrestaShop/productcomments/commit/314456d739155aa71f0b235827e8e0f24b97c26b
- Source reference github.com/PrestaShop/productcomments