CVE-2021-21302 CSV Injection via csv export
Attackers can inject malicious formulas into CSV exports via search keywords, potentially leading to code execution when the file is opened.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-21302?
CVE-2021-21302 is a medium-severity vulnerability in Prestashop Prestashop, published on 26 Feb 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
PrestaShop is a fully scalable open source e-commerce solution. In PrestaShop before version 1.7.2 there is a CSV Injection vulnerability possible by using shop search keywords via the admin panel. The problem is fixed in 1.7.7.2
Which versions are affected by CVE-2021-21302?
It affects 1 product.
Products include Prestashop Prestashop.
How do I fix CVE-2021-21302?
No fix has been published for CVE-2021-21302 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-21302 being exploited?
There is no known exploitation of CVE-2021-21302 in the wild and no public exploit code.
Other vulnerabilities in Prestashop Prestashop
Sources
Also known as GHSA-2rw4-2p99-cmx9.