How severe is CVE-2024-21627?

This vulnerability has a severity rating of MEDIUM with a CVSS score of 6.1 out of 10.

What type of vulnerability is CVE-2024-21627?

This is classified as CWE-20, which is a common weakness in software security.

CVE-2024-21627 - MEDIUM Severity | CVSS 6.1

Vulnerability Description

PrestaShop is an open-source e-commerce platform. Prior to versions 8.1.3 and 1.7.8.11, some event attributes are not detected by the `isCleanHTML` method. Some modules using the `isCleanHTML` method could be vulnerable to cross-site scripting. Versions 8.1.3 and 1.7.8.11 contain a patch for this issue. The best workaround is to use the `HTMLPurifier` library to sanitize html input coming from users. The library is already available as a dependency in the PrestaShop project. Beware though that in legacy object models, fields of `HTML` type will call `isCleanHTML`.

Related Vulnerabilities

CVE-2009-5158

MEDIUM

CVSS:6.1(Medium)

The google-analyticator plugin before 5.2.1 for WordPress has insufficient HTML sanitization for Google Analytics API text.

CWE-202009

CVE-2014-9678

MEDIUM

CVSS:6.1(Medium)

FlexPaperViewer.swf in Flexpaper before 2.3.1 allows remote attackers to conduct content-spoofing attacks via the Swfile parameter.

CWE-202014

CVE-2015-2918

MEDIUM

CVSS:6.1(Medium)

The Studio component in OrientDB Server Community Edition before 2.0.15 and 2.1.x before 2.1.1 does not properly restrict use of FRAME elements, which makes it easier for remote attackers to conduct c...

CWE-202015

CVE-2015-8682

MEDIUM

CVSS:6.1(Medium)

The Video0 driver in Huawei P8 smartphones with software GRA-UL00 before GRA-UL00C00B350, GRA-UL10 before GRA-UL10C00B350, GRA-TL00 before GRA-TL00C01B350, GRA-CL00 before GRA-CL00C92B350, and GRA-CL1...

CWE-202015

CVE-2015-8760

MEDIUM

CVSS:6.1(Medium)

The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."

CWE-202015

CVE-2016-0789

MEDIUM

CVSS:6.1(Medium)

CRLF injection vulnerability in the CLI command documentation in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splittin...

CWE-202016