Cross-Site Scripting (XSS)

2020-11-1705:16:58

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

prestashop

productcomments

cross-site scripting

xss

remote attacker

arbitrary javascript

browser

parameters

application

content-type

server response

application/json

vulnerability

html

unescaped.

EPSS

0.001

Percentile

29.3%

JSON

prestashop/productcomments is vulnerable to cross-site scripting (XSS). A remote attacker is able to inject and execute arbitrary Javascript in a user’s browser via various parameters within the application. The vulnerability exists as the content-type of the server response is not set to application/json, causing the browser to interpret the JSON response as HTML and render any unescaped HTML.