{"id":"GHSA-6grv-hw8g-4gfm","aliases":["CVE-2019-11876"],"title":"PrestaShop Cross-site Scripting vulnerability","description":"In PrestaShop 1.7.5.2, the `shop_country` parameter in the `install/index.php` installation `script/component` is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link.","severity":"medium","score":6.1,"published":"2022-05-24T16:46:36.000Z","modified":"2024-04-23T17:28:55.711Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"prestashop/prestashop","ranges":[{"events":[{"introduced":"1.7.5.2"},{"fixed":"1.7.6.0"}],"type":"ECOSYSTEM"}],"versions":["1.7.5.2","1.7.6.0-beta.1","1.7.6.0-rc.1","1.7.6.0-rc.2"],"fixed":["1.7.6.0"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2019-11876","https://github.com/PrestaShop/PrestaShop","https://www.logicallysecure.com/blog/xss-presta-xss-drupal","https://www.prestashop.com/forums/forum/2-prestashop-news-and-releases"],"sources":[{"name":"OSV","id":"GHSA-6grv-hw8g-4gfm","modified":"2024-04-23T17:28:55.711334Z","url":"https://osv.dev/vulnerability/GHSA-6grv-hw8g-4gfm"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}]}