PT-2021-14492 · Unknown · Ps Emailsubscription

Atomiix · Published 2021-03-31 · Updated 2021-04-06 · CVE-2021-21418

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ps emailsubscription versions prior to 2.6.1

Description The issue allows an employee to inject javascript in the newsletter condition field, which will then be executed on the front office.

Recommendations For versions prior to 2.6.1, update to version 2.6.1 to resolve the issue. As a temporary workaround, consider restricting access to the newsletter condition field to prevent potential javascript injection until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-21418

GHSA-VWFX-HH3W-FJ99

Affected Products

Ps Emailsubscription

References · 7

• https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70 · Patch
• https://osv.dev/vulnerability/GHSA-vwfx-hh3w-fj99 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21418 · Security Note
• https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99 · Note
• https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1 · Note
• https://packagist.org/packages/prestashop/ps_emailsubscription · Note