Stored XSS on back office edit page
CVE-2020-5266

4.4MEDIUM

Key Information:

Vendor

Prestashop

Status
Ps Linklist
Vendor
CVE Published:
16 April 2020

What is CVE-2020-5266?

In the ps_link module for PrestaShop before version 3.1.0, there is a stored XSS when you create or edit a link list block with the title field. The problem is fixed in 3.1.0

Affected Version(s)

ps_linklist < 3.1.0

References

https://github.com/PrestaShop/ps_linklist/security/adviso...
x_refsource_CONFIRM
https://github.com/PrestaShop/ps_linklist/commit/b90005c2...
x_refsource_MISC

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
The Cyber Security Vulnerability Database.