CVE-2020-15161

low-risk
Published 2020-09-24

In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8

Do I need to act?

-
0.29% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.4/10 Medium
NETWORK / HIGH complexity

Affected Products (1)

Affected Vendors

Prestashop

References (6)

Patch https://github.com/PrestaShop/PrestaShop/commit/562a231fec18a928e4a601860416fe11...
Third Party Advisory https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
Third Party Advisory https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-5cp2-r794-w37w
Patch https://github.com/PrestaShop/PrestaShop/commit/562a231fec18a928e4a601860416fe11...
Third Party Advisory https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.6.8
Third Party Advisory https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-5cp2-r794-w37w
23
/ 100
low-risk
Severity 17/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal