Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2013-4791
CVE-2013-4791:
PHP vulnerability analysis and mitigation
Overview
PrestaShop before version 1.4.11 contained a persistent Cross-Site Scripting (XSS) vulnerability that allowed users with low-level privileges such as Logisticians and translators to inject malicious code through the TinyMCE editor. The vulnerability was discovered in July 2013 and assigned identifier CVE-2013-4791 (PrestaShop Blog).
Technical details
The vulnerability existed due to insufficient filtering of HTML events in the TinyMCE editor. Low-privileged users could inject malicious HTML code in CMS pages through TinyMCE's HTML mode, which would then execute when viewed by other users including administrators (PrestaShop Blog).
Impact
The vulnerability could be exploited to automatically log out administrators when hovering over injected content, spread malware, or steal user credentials through fake login prompts affecting visitors, authenticated users and administrators (PrestaShop Blog).
Mitigation and workarounds
The vulnerability was fixed in PrestaShop version 1.4.11 and later versions of the 1.5.x branch. Users were advised to upgrade to these patched versions. The fix involved updating to a newer version of TinyMCE that properly filtered HTML events (PrestaShop Blog).
Community reactions
The PrestaShop development team acknowledged and addressed the vulnerability promptly after it was reported. They released a fix in version 1.4.11 and committed to backporting the patch to the 1.5.x branch (PrestaShop Blog).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management