CVE-2022-35933

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

This package is a PrestaShop module that allows users to post reviews and rate products. There is a vulnerability where the attacker could steal an administrator's cookie. The issue is fixed in version 5.0.2.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
PrestaShop	productcomments	< 5.0.2

References

https://github.com/PrestaShop/productcomments/commit/314456d739155aa71f0b235827e8e0f24b97c26bPatch, Third Party Advisory
https://github.com/PrestaShop/productcomments/security/advisories/GHSA-prrh-qvhf-x788Third Party Advisory
https://github.com/PrestaShop/productcomments/commit/314456d739155aa71f0b235827e8e0f24b97c26bPatch, Third Party Advisory
https://github.com/PrestaShop/productcomments/security/advisories/GHSA-prrh-qvhf-x788Third Party Advisory

Timeline

Published: Sep 2, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-359347.5TensorFlow is an open source platform for machine learning. The implementation of tf.reshape op in TensorFlow is vulnerable to a denial of s CVE-2022-359357.5TensorFlow is an open source platform for machine learning. The implementation of SobolSampleOp is vulnerable to a denial of service via CHE CVE-2022-359365.3Ethermint is an Ethereum library. In Ethermint running versions before `v0.17.2`, the contract `selfdestruct` invocation permanently removes CVE-2022-359379.1TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and o CVE-2022-359389.1TensorFlow is an open source platform for machine learning. The `GatherNd` function takes arguments that determine the sizes of inputs and o CVE-2022-359399.8TensorFlow is an open source platform for machine learning. The `ScatterNd` function takes an input argument that determines the indices of CVE-2022-35945.3A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback CVE-2022-359407.5TensorFlow is an open source platform for machine learning. The `RaggedRangOp` function takes an argument `limits` that is eventually used t CVE-2022-359417.5TensorFlow is an open source platform for machine learning. The `AvgPoolOp` function takes an argument `ksize` that must be positive but is CVE-2022-3594210.0Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contai CVE-2022-359438.8Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitak CVE-2022-359447.2October is a self-hosted Content Management System (CMS) platform based on the Laravel PHP Framework. This vulnerability only affects instal