CVE-2020-15162 MEDIUM

CVE-2020-15162: Stored XSS in PrestaShop

Vendor Prestashop
Product PrestaShop
Weakness CWE-79 · XSS
Published September 24, 2020
Last update August 4, 2024
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

In PrestaShop from version 1.5.0.0 and before version 1.7.6.8, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version 1.7.6.8.

Key dates

02Disclosure timeline

September 24, 2020 CVE published
August 4, 2024 Record updated