CVE-2022-31101
Assigner: GitHub_M
Published: 2022-06-27T22:15:20
State: PUBLISHED
affected: product: blockwishlist
vendor: PrestaShop
versions: status: affected
version: >= 2.0.0, < 2.1.1
descriptions: value: prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
type: CWE
source: advisory: GHSA-2jx3-5j9v-prpp
discovery: UNKNOWN
title: SQL Injection in prestashop/blockwishlist