CVE-2021-21418 Potential XSS injection in the newsletter conditions field

2021-03-3117:35:15

CWE-79

GitHub_M

www.cve.org

xss injection

ps_emailsubscription

newsletter

prestashop

fixed version

CVSS3

4.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS

0.001

Percentile

31.7%

JSON

ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1

CNA Affected

[
  {
    "product": "ps_emailsubscription",
    "vendor": "PrestaShop",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.6.1"
      }
    ]
  }
]