CVE-2020-11074: 
Prestashop vulnerability analysis and mitigation

In PrestaShop versions from 1.5.3.0 and before version 1.7.6.6, a stored Cross-Site Scripting (XSS) vulnerability was discovered that affects the AdminQuickAccesses functionality (GitHub Advisory).

The vulnerability allows for stored XSS attacks through the name field of quick access items. The issue was assigned CVE-2020-11074 and is classified as a Moderate severity vulnerability. The vulnerability falls under the CWE-79 category (Cross-site Scripting - Stored) (GitHub Advisory).

When exploited, this vulnerability could allow attackers to execute malicious scripts through stored quick access item names, potentially leading to unauthorized access to sensitive information or performing actions on behalf of other users (GitHub Advisory).

The vulnerability can be exploited when a malicious actor manages to store a specially crafted name in a quick access item. Users who subsequently view or interact with these quick access items could trigger the malicious script (GitHub Advisory).

The vulnerability has been patched in PrestaShop version 1.7.6.6. As a temporary workaround, users are advised to avoid clicking on suspicious quick access names. Additionally, suspicious items can be removed by identifying their ID and executing a SQL query to delete them from the ps_quick_access table (GitHub Advisory).