CVE-2022-31101CWE-89

SQL Injection in prestashop/blockwishlist

High · published June 27, 2022

CVSS v3.1

8.1

EPSS

23%

Percentile

97.8

In the wild

Unconfirmed

What it is

prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0: Not supplied
EPSS: 0.23492 · 97.8th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2022-06-27T22:15Z

EPSS history

Timeline

27 JUN 22:15Z
SQL Injection in prestashop/blockwishlist
cvelistv5