{"id":"GHSA-prrh-qvhf-x788","aliases":["CVE-2022-35933"],"title":"PrestaShop Product Comments Cross-site Scripting vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"### Impact\nAn attacker could steal an admin's cookie\n\n### Patches\nThe issue is fixed in 5.0.2\n\n### References\n[Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')](https://cwe.mitre.org/data/definitions/79.html)\n","severity":"medium","score":4.3,"published":"2022-08-31T21:27:38.000Z","modified":"2023-11-08T04:09:53.097Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"prestashop/productcomments","sources":[{"name":"OSV · GHSA-prrh-qvhf-x788","url":"https://osv.dev/vulnerability/GHSA-prrh-qvhf-x788"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"5.0.2"}],"type":"ECOSYSTEM"}],"versions":["4.2.1","v3.6.0","v3.6.1","v4.0.0","v4.0.1","v4.1.0","v4.2.0","v4.2.2","v5.0.0","v5.0.1"],"fixed":["5.0.2"]}],"sourceAffected":[],"references":["https://github.com/PrestaShop/productcomments/security/advisories/GHSA-prrh-qvhf-x788","https://nvd.nist.gov/vuln/detail/CVE-2022-35933","https://github.com/PrestaShop/productcomments/commit/314456d739155aa71f0b235827e8e0f24b97c26b","https://github.com/PrestaShop/productcomments"],"sources":[{"name":"OSV","id":"GHSA-prrh-qvhf-x788","modified":"2023-11-08T04:09:53.097557Z","url":"https://osv.dev/vulnerability/GHSA-prrh-qvhf-x788"}],"assessments":[{"source":"OSV","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","score":4.3}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T14:45:35.401Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}