CVE-2024-34716 in the critical feed json
PrestaShop vulnerable to XSS via customer contact form in FO, through file upload
published 2024-05-14 2 y ago modified 2026-09-10 1 mo ago also EUVD-2024-1402 , GHSA-45vm-3j38-7p78
- cvss
- 9.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 56.4%
- EPSS 56.4% chance of exploitation in 30 days, percentile 99%
- public exploits
- 0
- none known
Summary
PrestaShop is an open source e-commerce web application. A cross-site scripting (XSS) vulnerability that only affects PrestaShops with customer-thread feature flag enabled is present starting from PrestaShop 8.1.0 and prior to PrestaShop 8.1.6. When the customer thread feature flag is enabled through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office. The script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right. This vulnerability is patched in 8.1.6. A workaround is to disable the customer-thread feature-flag.
Patch / fix
- packagist prestashop/prestashop 8.1.6
- PrestaShop PrestaShop 8.1.6
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
56.45% chance of exploitation in the next 30 days, higher than 99% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.7 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | prestashop/prestashop | >=8.1.0, <8.1.6 |
8.1.6 |
Affected products
- PrestaShop PrestaShop
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/PrestaShop/PrestaShop/commit/a248898655e56cbcc6c308a5f1c8752231624bae
web
-
github.com
/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78
web, vendor-advisory
-
github.com
/PrestaShop/PrestaShop/releases/tag/8.1.6
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2024-34716
advisory
-
github.com
/PrestaShop/PrestaShop
package
Sources
- CVE List CVE-2024-34716
- GitHub Advisory GHSA-45vm-3j38-7p78
- NVD CVE-2024-34716
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.