CVE-2021-33351

CRITICAL 9.0EPSS 1.0%

Cross Site Scripting Vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before and fixed in v.1.3.7 allows attackers to escalte privileges via a crafted payload in the ticket message field.

CVSS v3.1: 9.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS v3.1: 9.0 CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
EPSS: 1.03% chance of exploitation in the next 30 days, 61th percentile
Published: 2023-03-08
Updated: 2025-03-05

Proof-of-concept exploits (1)

https://www.exploit-db.com/exploits/50113

References

Related