CVE-2021-21418mediumCWE-79

CVE-2021-21418: fallo de gravedad media en PrestaShop ps_emailsubscription

Potential XSS injection in the newsletter conditions field

Publicada el 31 mar 2021 · Actualizada el 03 ago 2024

Seguir esta CVE + Monitorear ps emailsubscription + Monitorear prestashop/ps_emailsubscription

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 4.6epss 0.8%

ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Productos afectados

PrestaShop · ps_emailsubscription

Referencias

https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70 https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1 https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99 https://packagist.org/packages/prestashop/ps_emailsubscription