CVE-2021-21302CWE-78

CSV Injection via csv export

Medium · published February 26, 2021

CVSS v3.1
6.8
EPSS
2%
Percentile
84.1
In the wild
Unconfirmed
What it is

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02425 · 84.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2021-02-26T19:45Z
EPSS history
Timeline
  • 26 FEB 19:45Z
    CSV Injection via csv export
    cvelistv5