UpHeron
All vulnerabilities

Servers and applications

CVE-2024-21627

Some attribute not escaped in Validate::isCleanHTML method

Severity
Medium 6.1
Published
2 Jan 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.7.8.11, 8.1.3
Also known as
GHSA-xgpm-q3mq-46rq
Sources
NVD, Project advisories (GitHub)

Description

PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from…

Affected software

SoftwareAffected versions
PrestaShopServers and applications · cpe:a:prestashop:prestashop
  • Every version before 1.7.8.11
  • From 8.0.0 before 8.1.3
PrestaShopServers and applications · github:prestashop/prestashop
  • Every version before 1.7.8.11

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-21627
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-21627
  • GitHub Advisory Database https://github.com/advisories/GHSA-xgpm-q3mq-46rq
  • github.com https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-xgpm-q3mq-46rq