GoogleOSV:CVE-2021-21418

HistoryMar 31, 2021 - 6:15 p.m.

CVE-2021-21418

2021-03-3118:15:14

Google

osv.dev

cve-2021-21418

prestashop

ps_emailsubscription

injection vulnerability

newsletter condition field

front office

software

fix 2.6.1

AI Score

6.8

Confidence

High

EPSS

0.001

Percentile

31.7%

JSON

ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1

References

github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70

github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1

github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99

packagist.org/packages/prestashop/ps_emailsubscription