What is CVE-2012-20001?

CVE-2012-20001 is a medium-severity vulnerability; its CVE record was published on December 21, 2021. PrestaShop before 1.5.2 allows XSS via the "\u003cobject data='data:text/html" substring in the message field.

When was the CVE record for CVE-2012-20001 published?

The CVE record for CVE-2012-20001 was published on December 21, 2021. That is the record's publication date; the vulnerability itself may have been made public earlier. EchelonGraph's copy of the record carries a last-modified date of November 21, 2024; the record at its source may have been updated since.

Is CVE-2012-20001 actively exploited?

CVE-2012-20001 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0.8% probability of exploitation in the next 30 days (56th percentile of EPSS-scored CVEs).

What is the CVSS score of CVE-2012-20001?

CVE-2012-20001 has a CVSS v3 base score of 6.1 (NVD).

How do I remediate CVE-2012-20001?

A fix for CVE-2012-20001 is available: update to the fixed version the vendor names in its advisory.

CVE-2012-20001

MEDIUMNVD 6.16.1

6.1EG

EchelonGraph verdictMonitorRemediate within your standard update timelines (the SSVC decision on this page).

Lower severity and no public exploit yet

CISA-KEV: Not listedEPSS PROB: 0.8%CVSS: 6.1Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

PrestaShop before 1.5.2 allows XSS via the "