Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-30838

CVE-2023-30838: Possible XSS injection through Validate::isCleanHTML method

8.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-30838
GHSA ID
GHSA-fh7r-996q-gvcp
EPSS Score
0.65739%
CWE
CWE-79
Published
4/25/2023
Updated
11/10/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
prestashop/prestashopcomposer>= 8.0.0, < 8.0.48.0.4
prestashop/prestashopcomposer< 1.7.8.91.7.8.9

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems directly from the Validate::isCleanHtml method's incomplete event handler validation. The commit diff explicitly shows the addition of animation-related events (onanimationcancel, onanimationend, etc.) to the regex pattern, indicating these were previously missing. Since this function is responsible for sanitizing HTML input, the omission of these events allowed XSS payloads to bypass validation. The CVE description and patch context confirm this function was the attack vector.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t V*li**t**or*::is*l**n*TML() m*t*o* o* Pr*st*s*op miss*s *iji*k**l* *v*nts w*i** **n l*** to XSS inj**tion, *llow** *y t** pr*s*n** o* pr*-s*tup @k*y*r*m*s m*t*o*s. T*is XSS w*i** *ij**ks *TML *ttri*ut*s will ** tri***r** wit*out *ny int*r

Reasoning

T** vuln*r**ility st*ms *ir**tly *rom t** `V*li**t*::is*l**n*tml` m*t*o*'s in*ompl*t* *v*nt **n*l*r v*li**tion. T** *ommit *i** *xpli*itly s*ows t** ***ition o* *nim*tion-r*l*t** *v*nts (on*nim*tion**n**l, on*nim*tion*n*, *t*.) to t** r***x p*tt*rn,