CVE-2019-11876

Name of the Vulnerable Software and Affected Versions PrestaShop version 1.7.5.2

Description The issue concerns a Reflected XSS affecting the shop country parameter in the install/index.php installation script/component. Exploitation requires a user to follow the initial setup stages, including accepting terms and conditions, before executing a malicious link.

Recommendations For PrestaShop version 1.7.5.2, as a temporary workaround, consider restricting access to the install/index.php script until a patch is available. Avoid using the shop country parameter in the installation process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.