CVE-2024-34716 is a cross-site scripting (XSS) vulnerability affecting PrestaShop versions 8.1.0 through 8.1.5, specifically when the customer-thread feature is enabled. An attacker can upload a malicious file via the front-office contact form, which executes an XSS script when an administrator opens the attached file in the back office. This allows the attacker to perform authenticated actions within the administrator's privileges. Rated as Medium severity (CVSS 6.1), it has a low attack complexity but requires user interaction. There is currently no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.1.0, < 8.1.6CPE matchmatch criteria | cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.