CVE-2024-21627
Description
PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`.
How to fix
- prestashop prestashop1.7.8.11, 8.1.3 or later
- prestashop/prestashop8.1.3, 1.7.8.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| prestashop prestashop | v < 1.7.8.11, 8.0.0 ≤ v < 8.1.3 | 1.7.8.11, 8.1.3 |
| prestashop/prestashopPackagist | 8.0.0-beta.1 ≤ v < 8.1.3, v < 1.7.8.11 | 8.1.3, 1.7.8.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.