Medium severity · published Nov 28, 2023
CVE-2023-48042
Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote attackers to inject arbitrary JavaScript code
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
Cross Site Scripting (XSS) in Search filters in Prestashop Amazzing filter version up to version 3.2.5, allows remote attackers to inject arbitrary JavaScript code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Amazzing Filter · Communitydeveloper
through 3.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-48042
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-48042
Product
https://addons.prestashop.com/en/search-filters/18575-amazzing-filter.html
Third Party Advisory
https://medium.com/%40nasir.synack/uncovering-a-cross-site-scripting-vulnerability-cve-2023-48042-in-amazzing-filters-prestashop-2e4a9f8b655e