HIGH8.0
GHSA-95hx-62rh-gg96
Potential XSS injection In PrestaShop contactform
Quick fix
GHSA-95hx-62rh-gg96 — prestashop/contactform: upgrade to the fixed version with the command below.
composer require prestashop/contactform:^4.3.0Details
### Impact An attacker is able to inject javascript while using the contact form.
### Patches The problem is fixed in v4.3.0
### References [Cross-site Scripting (XSS) - Stored (CWE-79)](https://cwe.mitre.org/data/definitions/79.html)
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/prestashop/contactform
Introduced in:
1.0.1Fixed in: 4.3.0Fix
composer require prestashop/contactform:^4.3.0References
- https://github.com/PrestaShop/contactform/security/advisories/GHSA-95hx-62rh-gg96[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2020-15178[ADVISORY]
- https://github.com/PrestaShop/contactform/commit/a1da814bea7e5750b858a2dbbc58ace80379f42f[WEB]
- https://github.com/PrestaShop/contactform/commit/ecd9f5d14920ec00885766a7cb41bcc5ed8bfa09[WEB]
- https://github.com/PrestaShop/contactform[PACKAGE]
- https://packagist.org/packages/prestashop/contactform[WEB]