CVE-2020-15162

Katalog CVE

CVSS 5.4 · Medium EPSS 0,80%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada prestashop. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.

Rincian

Terbit di NVD

24 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,80% peluang dieksploitasi; lebih tinggi dari 55,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/PrestaShop/PrestaShop/commit/2cfcd33c75974a49f17665f294f228454e14d9cf patch · advisory pihak ketiga
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8 advisory pihak ketiga
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-rc8c-v7rq-q392 exploit · advisory pihak ketiga