CVE-2021-33561: XSS
A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customername in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-33561?
CVE-2021-33561 has a medium severity rating due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2021-33561?
To fix CVE-2021-33561, upgrade to Shopizer version 2.17.0 or later.
What types of attacks are possible due to CVE-2021-33561?
CVE-2021-33561 allows remote attackers to inject arbitrary web scripts or HTML, leading to potential data exfiltration or session hijacking.
Which versions of Shopizer are affected by CVE-2021-33561?
CVE-2021-33561 affects all versions of Shopizer prior to 2.17.0.
Who is impacted by CVE-2021-33561?
Any user of the store administration interface in affected versions of Shopizer is impacted by CVE-2021-33561.