Vulnerability · Published May 24, 2021 · Assigned by mitre

CVE-2021-33561

Medium 4.8

In plain English

A medium-severity security flaw in the com.shopizer:shopizer package (Maven). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.9% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)4.8Medium

Exploit odds (30 days)2.9%top 13.2% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	com.shopizer:shopizer	2.17.0	GHSA-rcp4-jm2v-mr3f

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/shopizer-ecommerce/shopizer/commit/197f8c78c8f673b957e41ca2c823afc654c19271 x_refsource_MISC
https://www.exploit-db.com/exploits/49901 x_refsource_MISC
https://github.com/shopizer-ecommerce/shopizer/compare/2.16.0...2.17.0 x_refsource_MISC