CVE-2022-35933 PrestaShop module Product Comments vulnerable to cross-site scripting (XSS)

2022-09-0219:30:14

CWE-79

GitHub_M

www.cve.org

prestashop

product comments

xss

vulnerability

version 5.0.2

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

0.001 Low

EPSS

Percentile

26.2%

JSON

This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator’s cookie. The issue is fixed in version 5.0.2.

CNA Affected

[
  {
    "product": "productcomments",
    "vendor": "PrestaShop",
    "versions": [
      {
        "status": "affected",
        "version": "< 5.0.2"
      }
    ]
  }
]