GitHub Advisoryadvisory · Packagist

GHSA-vwfx-hh3w-fj99 Potential XSS injection in the newsletter conditions field

MEDIUM Published 2021-04-06 Modified 2021-03-31 Official page ↗
Aliases
CVE-2021-21418
Ecosystem
Packagist
Packages
prestashop/ps_emailsubscription
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2021-03-31

Affected packages

• Packagist prestashop/ps_emailsubscription: < 2.6.1 → fixed in 2.6.1

Description

Impact An employee can inject javascript in the newsletter condition field that will then be executed on the front office Patches The issue has been fixed in 2.6.1

Related

Alias · CVE (1)

  • CVE-2021-21418 ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References