PT-2023-22579 · Prestashop · Myinventory

CVE-2023-30197 · Publicado 2023-05-31 · Atualizado 2025-01-09

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop module myinventory versions 1.6.6 and earlier

Description The issue allows unauthorized access to personal information due to incorrect access control in the myinventory module. This can be exploited by a guest performing a path traversal attack, enabling them to download sensitive data without restrictions.

Recommendations For versions 1.6.6 and earlier, update the myinventory module to a version later than 1.6.6 to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-30197

Produtos afetados

Myinventory

Referências · 4

• https://github.com/PrestaShop/PrestaShop/blob/6c05518b807d014ee8edb811041e3de232520c28/classes/Tools.php#L1247 · Nota
• https://osv.dev/vulnerability/CVE-2023-30197 · Aviso do Fabricante
• https://friends-of-presta.github.io/security-advisories/modules/2023/05/30/myinventory.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-30197 · Nota de Segurança