PT-2021-14475 · Unknown · Prestashop

Eterno · Published 2021-03-30 · Updated 2021-04-02 · CVE-2021-21398

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.7.3

Description The issue allows an attacker to inject HTML when the Grid Column Type DataColumn is not used correctly.

Recommendations For versions prior to 1.7.7.3, update to version 1.7.7.3 to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-21398

GHSA-FHHQ-4X46-QX77

Affected Products

Prestashop

References · 5

• https://github.com/PrestaShop/PrestaShop/commit/aaaba8177f3b3c510461b5e3249e30e60f900205 · Patch
• https://osv.dev/vulnerability/CVE-2021-21398 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21398 · Security Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-fhhq-4x46-qx77 · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.3 · Note