PT-2023-28908 · Unknown · Prestashop

Jolelievre · Publicado 2023-09-28 · Atualizado 2024-03-06 · CVE-2023-43663

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.2

Description PrestaShop is an Open Source e-commerce web application. In affected versions, any module can be disabled or uninstalled from the back office, even with low user rights. This allows low privileged users to disable portions of a shop's functionality.

Recommendations For versions prior to 8.1.2, upgrade to version 8.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the back office for low privileged users until the upgrade is applied. There are no known workarounds for this issue other than upgrading to the fixed version.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BIT-PRESTASHOP-2023-43663

CVE-2023-43663

GHSA-6JMF-2PFC-Q9M7

Produtos afetados

Prestashop

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43663.json · Exploit
• https://github.com/PrestaShop/PrestaShop · Nota
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-6jmf-2pfc-q9m7 · Aviso do Fabricante
• https://github.com/PrestaShop/PrestaShop/commit/ce1f67083537194e974caf86c57e547a0aaa46cd · Correção
• https://twitter.com/CVEnew/status/1707460155594703272 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-prestashop-2023-43663 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-6jmf-2pfc-q9m7 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-43663 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1707496324428419379 · Publicação no Twitter
• https://t.me/cibsecurity/71224 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-43663 · Nota de Segurança