CVE-2021-21302

Katalog CVE

CVSS 7.2 · High EPSS 2,4%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada prestashop. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2

Rincian

Terbit di NVD

26 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-1236: Improper Neutralization of Formula Elements in a CSV File

EPSS (30 hari)

2,4% peluang dieksploitasi; lebih tinggi dari 83,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/PrestaShop/PrestaShop/commit/782b1368aa4e94dafe28f57485bffbd8893fbb1e patch · advisory pihak ketiga
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 release notes · advisory pihak ketiga
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-2rw4-2p99-cmx9 advisory pihak ketiga