Detections
Analytics
SCA: security update for prestashop/ps_contactinfo (GHSA-35pq-7pv2-2rfw)
medium Tenable Cloud Security Plugin ID 409310
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting
(XSS) vulnerability in versions up to and including 3.3.2. This can not be exploited in a fresh install of
PrestaShop, only shops made vulnerable by third party modules are concerned. For example, if the shop has
a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored cross-site
scripting in formatting objects. Commit d60f9a5634b4fc2d3a8831fb08fe2e1f23cbfa39 keeps formatted addresses
from displaying a XSS stored in the database, and the fix is expected to be available in version 3.3.3. No
workarounds are available aside from applying the fix and keeping all modules maintained and update.
(CVE-2025-24027)
See Also
Plugin Details
Severity: Medium
ID: 409310
Version: Revision 1.18
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.5
Percentile: 57.08
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:H/Au:M/C:C/I:P/A:C
CVSS Score Source: CVE-2025-24027
CVSS v3
Risk Factor: Medium
Base Score: 6.2
Temporal Score: 5.4
Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 1/22/2025
Vulnerability Publication Date: 1/22/2025
Reference Information
CVE: CVE-2025-24027
cwe: CWE-79