github.com
https://github.com/PrestaShop/PrestaShop CVE-2023-43664
MEDIUM
Employee without any access rights can list all installed modules in Prestashop
Record summary
CVE-2023-43664 has a selected CVSS score of 4.3 (medium).
Description
PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been addressed in commit `15bd281c` which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 20, 2024 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
PrestaShopBrowse PrestaShop / PrestaShop | CVE List | < 8.1.2 | affected |
prestashop/prestashopBrowse Packagist / prestashop/prestashop | GitHub Advisory | Before 8.1.2 · Fixed in 8.1.2 | affected |
References
4github.com
https://github.com/PrestaShop/PrestaShop/commit/15bd281c18f032a5134a8d213b44d24829d45762 github.comConfirmation
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gvrg-62jp-rf7j nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-43664