PT-2023-22627 · King-Avis+1 · King-Avis+1

Testeurdestylos · Publicado 2023-06-02 · Atualizado 2023-06-12 · CVE-2023-3031

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions King-Avis versions prior to 17.3.15

Description The issue is related to Improper Limitation of a Pathname, leading to a Path Traversal vulnerability in the King-Avis module for Prestashop. This allows a user with knowledge of the download token to read arbitrary local files.

Recommendations For versions prior to 17.3.15, update to version 17.3.15 or later to resolve the issue. As a temporary workaround, consider restricting access to the download token to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2023-3031

Produtos afetados

King-Avis

Prestashop

Referências · 4

• 🔥 https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3031.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-3031 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-3031 · Aviso do Fabricante
• https://t.me/cvenotify/51622 · Publicação no Telegram