CVE-2021-21418
Published Mar 31, 2021
Last updated 4 years ago
Overview
- Description
- ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
- Source
- security-advisories@github.com
- NVD status
- Analyzed
Social media
- Hype score
- Not currently trending
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 5.4
- Impact score
- 2.7
- Exploitability score
- 2.3
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- Severity
- MEDIUM
CVSS 2.0
- Type
- Primary
- Base score
- 3.5
- Impact score
- 2.9
- Exploitability score
- 6.8
- Vector string
- AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
- security-advisories@github.com
- CWE-79
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:prestashop:ps_emailsubscription:*:*:*:*:*:prestashop:*:*",
"vulnerable": true,
"matchCriteriaId": "A29287B9-1B47-4CE8-AE05-170793901CC1",
"versionEndExcluding": "2.6.1",
"versionStartIncluding": "2.6.0"
}
],
"operator": "OR"
}
]
}
]