PT-2023-27000 · Unknown · Prestashop

Kto94 · Publicado 2023-08-07 · Atualizado 2024-03-06 · CVE-2023-39529

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.1

Description The issue allows an attacker to delete a file from the server by utilizing the Attachments controller and the Attachments API. There are no known workarounds for this issue.

Recommendations For PrestaShop versions prior to 8.1.1, update to version 8.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the Attachments controller and the Attachments API until the update is applied.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BIT-PRESTASHOP-2023-39529

CVE-2023-39529

GHSA-2RF5-3FW8-QM47

Produtos afetados

Prestashop

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39529.json · Exploit
• https://github.com/PrestaShop/PrestaShop · Nota
• https://github.com/PrestaShop/PrestaShop/commit/b08c647305dc1e9e6a2445b724d13a9733b6ed82 · Correção
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-2rf5-3fw8-qm47 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-39529 · Nota de Segurança
• https://t.me/cibsecurity/67930 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-prestashop-2023-39529 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-2rf5-3fw8-qm47 · Aviso do Fabricante
• https://t.me/cvenotify/55961 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-39529 · Aviso do Fabricante