PrestaShop Vulnerabilities and Affected Products
Vulnerabilities associated with M4 PDF plugin.
Products
Clear product- PrestaShop63 vulnerabilities
- productcomments3 vulnerabilities
- blockreassurance2 vulnerabilities
- fme2 vulnerabilities
- helpdesk2 vulnerabilities
- M4 PDF plugin2 vulnerabilities
- ps_facetedsearch2 vulnerabilities
- ps_linklist2 vulnerabilities
- abandoned_cart_reminder_pro1 vulnerability
- ask_for_a_quote1 vulnerability
- blockwishlist1 vulnerability
- channable1 vulnerability
- contactform1 vulnerability
- dashproducts1 vulnerability
- livechatpro1 vulnerability
- loginascustomerpro1 vulnerability
- m4_pdf1 vulnerability
- newsletter_popup_pro1 vulnerability
- poststaticfooter1 vulnerability
- ps_contactinfo1 vulnerability
- ps_emailsubscription1 vulnerability
- ps_socialfollow1 vulnerability
- quadra_informatique1 vulnerability
- scalapay1 vulnerability
- The firmware1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Cross-site Scripting in M4 PDF plugin for Prestashop sitesM4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pdf.php uses templates to dynamically create documents. In the case that the template does not exist, the application will return a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the parameter. CWE-79Sep 20, 2023 | CVSS3.5v3.1 | EPSS0.287% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2022-45447MEDIUM | Path Traversal in M4 PDF plugin for Prestashop sitesM4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to a directory traversal vulnerability. The “f” parameter is not properly checked in the resource /m4pdf/pdf.php, returning any file given its relative path. An attacker that exploits this vulnerability could download /etc/passwd from the server if the file exists. CWE-22Sep 20, 2023 | CVSS6.5v3.1 | EPSS0.713% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |