PrestaShop Cross-Site Scripting Vulnerability Affects Customer Thread Feature

CVE-2024-34716

What is CVE-2024-34716?

A cross-site scripting (XSS) vulnerability exists in PrestaShop, an open-source e-commerce web application, specifically affecting installations with the customer-thread feature enabled. This issue arises in versions from 8.1.0 to 8.1.5. Under certain conditions, a malicious actor can leverage the front-office contact form to upload a file that contains a harmful script. When an administrator accesses this file within the back office, the script executes, potentially granting the attacker access to sensitive session information and security tokens. This exploitation enables unauthorized actions under the administrator's privileges. The vulnerability has been resolved in version 8.1.6, and as an interim measure, it is advisable to disable the customer-thread feature-flag to mitigate risks.

References