CVE-2021-43789

Description

### Impact Blind SQLi using Search filters with `orderBy` and `sortOrder` parameters ### Patches The problem is fixed in 1.7.8.2

How to fix CVE-2021-43789

To remediate CVE-2021-43789, upgrade the affected package to a fixed version below.

• Packagist/prestashop/prestashop—upgrade to 1.7.8.2 or later

Is CVE-2021-43789 being exploited?

Moderate — EPSS is 11.7%. Track this CVE but it's not at the top of the prioritisation list.

Affected packages (1)

• >= 1.7.5.0, < 1.7.8.2

CVSS scores

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-43789
• PATCHgithub.com/PrestaShop/PrestaShop
• WEBcwe.mitre.org/data/definitions/89.html
• WEBgithub.com/PrestaShop/PrestaShop/commit/6482b9ddc9dcebf7588dbfd616d2d635218408d6
• WEB