CVE-2021-33562: XSS
Published May 24, 2021
·Updated
A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.
Affected Software
1 affected component
Shopizer Shopizer<2.17.0
Remediation
Event History
May 24, 2021
CVE Published
via MITRE·10:33 PM
Data Sourced
via MITRE·10:33 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2021-33562?
The severity of CVE-2021-33562 is medium with a severity value of 4.8.
2
How does CVE-2021-33562 affect Shopizer?
CVE-2021-33562 affects Shopizer versions up to and including 2.17.0.
3
What is the CWE category of CVE-2021-33562?
CVE-2021-33562 falls under the CWE category 79: Cross-Site Scripting (XSS).
4
How can remote attackers exploit CVE-2021-33562?
Remote attackers can exploit CVE-2021-33562 by injecting arbitrary web script or HTML via the ref parameter on a product page.
5
How can I fix CVE-2021-33562?
To fix CVE-2021-33562, it is recommended to upgrade to version 2.17.0 or higher of Shopizer.