Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-ws23-cmum-kyh6
Summary
PrestaShop cross-site scripting via customer contact form in FO, through file upload
### Impact
Only PrestaShops with customer-thread feature flag enabled are impacted, starting from PrestaShop 8.1.0.

The impact is substantial, when the customer thread feature flag is enabled, through the front-office contact form, a hacker can upload a malicious file containing an XSS that will be executed when an admin opens the attached file in back office.

Consequence: the script injected can access the session and the security token, which allows it to perform any authenticated action in the scope of the administrator's right.

### Patches
This vulnerability is patched in 8.1.6.

### Workarounds
As long as you have not upgraded to 8.1.6, a simple workaround is to disable the customer-thread feature-flag.

Thank you to Ayoub AIT ELMOKHTAR, who discovered this vulnerability and share it with the PrestaShop team.
Aliases
0
alias CVE-2024-34716
1
alias GHSA-45vm-3j38-7p78
Fixed_packages
0
url pkg:composer/prestashop/prestashop@8.1.6
purl pkg:composer/prestashop/prestashop@8.1.6
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1trs-ajxn-jkhk
1
vulnerability VCID-cf1h-m5xj-mfc5
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/prestashop/prestashop@8.1.6
Affected_packages
0
url pkg:composer/prestashop/prestashop@8.1.0
purl pkg:composer/prestashop/prestashop@8.1.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1trs-ajxn-jkhk
1
vulnerability VCID-22v3-9qr1-pyfg
2
vulnerability VCID-5s8z-4eqn-p7h7
3
vulnerability VCID-7wj5-37ma-hbhg
4
vulnerability VCID-8beq-8rca-mbhd
5
vulnerability VCID-c4g5-t8vx-syax
6
vulnerability VCID-cf1h-m5xj-mfc5
7
vulnerability VCID-ey36-u4qn-gbge
8
vulnerability VCID-f4m9-pgg8-nqa3
9
vulnerability VCID-f7s4-16b7-zkcm
10
vulnerability VCID-fkcb-5u24-wqbg
11
vulnerability VCID-keyj-v83x-nkck
12
vulnerability VCID-kwe1-5ukw-cbau
13
vulnerability VCID-mb3x-p2d7-gqdx
14
vulnerability VCID-ws23-cmum-kyh6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/prestashop/prestashop@8.1.0
1
url pkg:composer/prestashop/prestashop@8.1.1
purl pkg:composer/prestashop/prestashop@8.1.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1trs-ajxn-jkhk
1
vulnerability VCID-5s8z-4eqn-p7h7
2
vulnerability VCID-cf1h-m5xj-mfc5
3
vulnerability VCID-ey36-u4qn-gbge
4
vulnerability VCID-f4m9-pgg8-nqa3
5
vulnerability VCID-fkcb-5u24-wqbg
6
vulnerability VCID-keyj-v83x-nkck
7
vulnerability VCID-ws23-cmum-kyh6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/prestashop/prestashop@8.1.1
2
url pkg:composer/prestashop/prestashop@8.1.2
purl pkg:composer/prestashop/prestashop@8.1.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1trs-ajxn-jkhk
1
vulnerability VCID-5s8z-4eqn-p7h7
2
vulnerability VCID-cf1h-m5xj-mfc5
3
vulnerability VCID-f4m9-pgg8-nqa3
4
vulnerability VCID-fkcb-5u24-wqbg
5
vulnerability VCID-ws23-cmum-kyh6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/prestashop/prestashop@8.1.2
3
url pkg:composer/prestashop/prestashop@8.1.3
purl pkg:composer/prestashop/prestashop@8.1.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1trs-ajxn-jkhk
1
vulnerability VCID-5s8z-4eqn-p7h7
2
vulnerability VCID-cf1h-m5xj-mfc5
3
vulnerability VCID-ws23-cmum-kyh6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/prestashop/prestashop@8.1.3
4
url pkg:composer/prestashop/prestashop@8.1.4
purl pkg:composer/prestashop/prestashop@8.1.4
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1trs-ajxn-jkhk
1
vulnerability VCID-cf1h-m5xj-mfc5
2
vulnerability VCID-ws23-cmum-kyh6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/prestashop/prestashop@8.1.4
5
url pkg:composer/prestashop/prestashop@8.1.5
purl pkg:composer/prestashop/prestashop@8.1.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1trs-ajxn-jkhk
1
vulnerability VCID-cf1h-m5xj-mfc5
2
vulnerability VCID-wruz-92je-97ej
3
vulnerability VCID-ws23-cmum-kyh6
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/prestashop/prestashop@8.1.5
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2024-34716
reference_id
reference_type
scores
0
value 0.36665
scoring_system epss
scoring_elements 0.9713
published_at 2026-04-08T12:55:00Z
1
value 0.36665
scoring_system epss
scoring_elements 0.97147
published_at 2026-04-18T12:55:00Z
2
value 0.36665
scoring_system epss
scoring_elements 0.97145
published_at 2026-04-16T12:55:00Z
3
value 0.36665
scoring_system epss
scoring_elements 0.97137
published_at 2026-04-13T12:55:00Z
4
value 0.36665
scoring_system epss
scoring_elements 0.97136
published_at 2026-04-12T12:55:00Z
5
value 0.36665
scoring_system epss
scoring_elements 0.97135
published_at 2026-04-11T12:55:00Z
6
value 0.36665
scoring_system epss
scoring_elements 0.97131
published_at 2026-04-09T12:55:00Z
7
value 0.36665
scoring_system epss
scoring_elements 0.97114
published_at 2026-04-02T12:55:00Z
8
value 0.36665
scoring_system epss
scoring_elements 0.9712
published_at 2026-04-04T12:55:00Z
9
value 0.36665
scoring_system epss
scoring_elements 0.97121
published_at 2026-04-07T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2024-34716
1
reference_url https://github.com/PrestaShop/PrestaShop
reference_id
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/PrestaShop/PrestaShop
2
reference_url https://github.com/PrestaShop/PrestaShop/commit/a248898655e56cbcc6c308a5f1c8752231624bae
reference_id
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/PrestaShop/PrestaShop/commit/a248898655e56cbcc6c308a5f1c8752231624bae
3
reference_url https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
reference_id
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value 9.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
2
value CRITICAL
scoring_system generic_textual
scoring_elements
3
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-06-11T20:41:38Z/
url https://github.com/PrestaShop/PrestaShop/releases/tag/8.1.6
4
reference_url https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78
reference_id
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value 9.7
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
2
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
3
value CRITICAL
scoring_system generic_textual
scoring_elements
4
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2024-06-11T20:41:38Z/
url https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-45vm-3j38-7p78
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2024-34716
reference_id
reference_type
scores
0
value 9.6
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2024-34716
6
reference_url https://github.com/advisories/GHSA-45vm-3j38-7p78
reference_id GHSA-45vm-3j38-7p78
reference_type
scores
0
value CRITICAL
scoring_system cvssv3.1_qr
scoring_elements
url https://github.com/advisories/GHSA-45vm-3j38-7p78
Weaknesses
0
cwe_id 79
name Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
description The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
1
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
2
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
Exploits
Severity_range_score9.0 - 10.0
Exploitability0.5
Weighted_severity9.0
Risk_score4.5
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-ws23-cmum-kyh6