Detections
Analytics

SCA: security update for prestashop/ps_contactinfo (GHSA-35pq-7pv2-2rfw)

medium Tenable Self-Hosted Container Security Plugin ID 409310

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - ps_contactinfo, a PrestaShop module for displaying store contact information, has a cross-site scripting
 (XSS) vulnerability in versions up to and including 3.3.2. This can not be exploited in a fresh install of
 PrestaShop, only shops made vulnerable by third party modules are concerned. For example, if the shop has
 a third party module vulnerable to SQL injections, then ps_contactinfo might execute a stored cross-site
 scripting in formatting objects. Commit d60f9a5634b4fc2d3a8831fb08fe2e1f23cbfa39 keeps formatted addresses
 from displaying a XSS stored in the database, and the fix is expected to be available in version 3.3.3. No
 workarounds are available aside from applying the fix and keeping all modules maintained and update.
 (CVE-2025-24027)

See Also

https://github.com/advisories/GHSA-35pq-7pv2-2rfw

Plugin Details

Severity: Medium

ID: 409310

Version: Revision 1.18

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.08

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:H/Au:M/C:C/I:P/A:C

CVSS Score Source: CVE-2025-24027

CVSS v3

Risk Factor: Medium

Base Score: 6.2

Temporal Score: 5.4

Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/22/2025

Vulnerability Publication Date: 1/22/2025

Reference Information

CVE: CVE-2025-24027

cwe: CWE-79