Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1tOXI0LTNmZzctcHFtMs4AA1LV

PrestaShop path traversal

Impact

In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path.

Patches

8.1.1

Found by

Aleksey Solovev (Positive Technologies)

Workarounds

none

References

none

Permalink: https://github.com/advisories/GHSA-m9r4-3fg7-pqm2
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tOXI0LTNmZzctcHFtMs4AA1LV
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 9 months ago
Updated: 6 months ago

CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Identifiers: GHSA-m9r4-3fg7-pqm2, CVE-2023-39525
References:

• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-m9r4-3fg7-pqm2
• https://nvd.nist.gov/vuln/detail/CVE-2023-39525
• https://github.com/PrestaShop/PrestaShop/commit/c7c9a5110421bb2856f4d312ecce192d079b5ec7
• https://github.com/advisories/GHSA-m9r4-3fg7-pqm2

Repository: https://github.com/PrestaShop/PrestaShop
Blast Radius: 2.0

Affected Packages