Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS12NGdyLXY2NzktNDJwN84AA1La

PrestaShop file deletion via CustomerMessage

Impact

It is possible to delete files from the server via the CustomerMessage API

Patches

8.1.1

Found by

Kto94 (via Yeswehack)

Workarounds

none

References

none

Permalink: https://github.com/advisories/GHSA-v4gr-v679-42p7
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS12NGdyLXY2NzktNDJwN84AA1La
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 1 year ago
Updated: about 1 year ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

EPSS Percentage: 0.00107
EPSS Percentile: 0.44509

Identifiers: GHSA-v4gr-v679-42p7, CVE-2023-39530
References:

• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-v4gr-v679-42p7
• https://nvd.nist.gov/vuln/detail/CVE-2023-39530
• https://github.com/PrestaShop/PrestaShop/commit/6ce750b2367a7309b6bf50166f1873cb86ad57e9
• https://github.com/advisories/GHSA-v4gr-v679-42p7

Repository: https://github.com/PrestaShop/PrestaShop
Blast Radius: 2.0

Affected Packages