CVE-2021-27190

Опубликовано: 12 фев. 2021

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0, which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.

Ссылки

https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611
Patch
Third Party Advisory
https://github.com/anmolksachan/CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS
Exploit
Third Party Advisory
https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS
Exploit
Third Party Advisory
https://www.peel-shopping.com/modules/telechargement/telecharger.php?id=7
Product
Vendor Advisory
https://www.secuneus.com/cve-2021-27190-peel-shopping-ecommerce-shopping-cart-stored-cross-site-scripting-vulnerability-in-address/
Exploit
Third Party Advisory
https://github.com/advisto/peel-shopping/issues/4#issuecomment-953461611
Patch
Third Party Advisory
https://github.com/anmolksachan/CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS
Exploit
Third Party Advisory
https://github.com/vulf/Peel-Shopping-cart-9.4.0-Stored-XSS
Exploit
Third Party Advisory
https://www.peel-shopping.com/modules/telechargement/telecharger.php?id=7
Product
Vendor Advisory
https://www.secuneus.com/cve-2021-27190-peel-shopping-ecommerce-shopping-cart-stored-cross-site-scripting-vulnerability-in-address/
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:peel:peel_shopping:9.3.0:*:*:*:*:*:*:*

cpe:2.3:a:peel:peel_shopping:9.4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.03857

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-3j49-vwhx-x2h7

github

больше 3 лет назад

A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 which is publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie, redirect them to other malicious website, etc.