PT-2023-28909 · Unknown · Prestashop

Jolelievre · Publicado 2023-09-28 · Atualizado 2024-03-06 · CVE-2023-43664

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.2

Description The issue concerns the PrestaShop Back office interface, where an employee can list all modules without any access rights due to the method ajaxProcessGetPossibleHookingListForModule not checking access rights. This issue has been addressed in a commit included in version 8.1.2.

Recommendations For versions prior to 8.1.2, upgrade to version 8.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the ajaxProcessGetPossibleHookingListForModule method until the upgrade is applied.

Exploit

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

BIT-PRESTASHOP-2023-43664

CVE-2023-43664

GHSA-GVRG-62JP-RF7J

Produtos afetados

Prestashop

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43664.json · Exploit
• https://github.com/PrestaShop/PrestaShop · Nota
• https://github.com/PrestaShop/PrestaShop/commit/15bd281c18f032a5134a8d213b44d24829d45762 · Correção
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gvrg-62jp-rf7j · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gvrg-62jp-rf7j · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1707496071276970256 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-prestashop-2023-43664 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1707464961440559448 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-43664 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-43664 · Aviso do Fabricante
• https://t.me/cibsecurity/71225 · Publicação no Telegram