CVE-2021-21418: Potential XSS injection in the newsletter conditions field
First published: Wed Mar 31 2021(Updated: )
ps_emailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Prestashop Ps Emailsubscription | >=2.6.0<2.6.1 |
Remedy
https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/PrestaShop/ps_emailsubscription/commit/664ffb225e2afb4a32640bbedad667dc6e660b70
- https://github.com/PrestaShop/ps_emailsubscription/releases/tag/v2.6.1
- https://github.com/PrestaShop/ps_emailsubscription/security/advisories/GHSA-vwfx-hh3w-fj99
- https://packagist.org/packages/prestashop/ps_emailsubscription
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/remedy
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/prestashop
- canonical/prestashop ps emailsubscription
- version/prestashop ps emailsubscription/2.6.0