Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ3ZngtaGgzdy1majk5

Potential XSS injection in the newsletter conditions field

Impact

An employee can inject javascript in the newsletter condition field that will then be executed on the front office

Patches

The issue has been fixed in 2.6.1

Permalink: https://github.com/advisories/GHSA-vwfx-hh3w-fj99
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXZ3ZngtaGgzdy1majk5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 3 years ago
Updated: almost 2 years ago

CVSS Score: 4.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Identifiers: GHSA-vwfx-hh3w-fj99, CVE-2021-21418
References:

• https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99
• https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70
• https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1
• https://packagist.org/packages/prestashop/ps_emailsubscription
• https://nvd.nist.gov/vuln/detail/CVE-2021-21418
• https://github.com/advisories/GHSA-vwfx-hh3w-fj99

Repository: https://github.com/PrestaShop/ps_emailsubscription
Blast Radius: 11.2

Affected Packages