Vulnerability · Published Feb 26, 2021 · Assigned by GitHub_M
CVE-2021-21302CSV Injection via csv export
Medium 6.8
In plain English
A medium-severity OS command injection in PrestaShop from PrestaShop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)2.4%top 15.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PrestaShop | PrestaShop | >= 1.5.0, < 1.7.7.2 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N