CVE-2019-11876 - In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS

Back Back to CVE browser

MEDIUM

In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS

Published May 24, 2019

6.1

MEDIUM

CVSS 3.0

EPSS 0.89%

Description

In PrestaShop 1.7.5.2, the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2795
Advisory
https://github.com/advisories/GHSA-6grv-hw8g-4gfm
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-11876
https://www.logicallysecure.com/blog/xss-presta-xss-drupal
x_refsource_MISCExploitVendor Advisory
https://www.prestashop.com/forums/forum/2-prestashop-news-and-releases
x_refsource_MISCRelease NotesVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2795		Advisory
https://github.com/advisories/GHSA-6grv-hw8g-4gfm		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-11876
https://www.logicallysecure.com/blog/xss-presta-xss-drupal		x_refsource_MISCExploitVendor Advisory
https://www.prestashop.com/forums/forum/2-prestashop-news-and-releases		x_refsource_MISCRelease NotesVendor Advisory