PrestaShop XSS injection through Validate::isCleanHTML method
Date: 2023-08
Affected: composer/prestashop/prestashop, composer/prestashop/prestashop, composer/prestashop/prestashop
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-39527
CWE: CWE-116
CVSS: 8.3 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:H)

### Impact xss injection through `isCleanHTML` method ### Patches 1.7.8.10 8.0.5 8.1.1 ### Found by Aleksey Solovev (Positive Technologies) ### Workarounds ### References


Mitigations:

Architectural layers (MAESTRO):