Vulnerability · Published Mar 31, 2021 · Assigned by GitHub_M
CVE-2021-21418Potential XSS injection in the newsletter conditions field
Medium 4.6
In plain English
A medium-severity cross-site scripting in ps_emailsubscription from PrestaShop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.8%top 43.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | prestashop/ps_emailsubscription | 2.6.1 | GHSA-vwfx-hh3w-fj99 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PrestaShop | ps_emailsubscription | < 2.6.1 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
References
- https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99 x_refsource_CONFIRM
- https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70 x_refsource_MISC
- https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1 x_refsource_MISC
- https://packagist.org/packages/prestashop/ps_emailsubscription x_refsource_MISC