PT-2022-27775 · Unknown · Prestashop

Atomiix · Published 2022-12-08 · Updated 2023-07-07 · CVE-2022-46158

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.8.8

Description PrestaShop is an open-source e-commerce solution where versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. This could allow users to view the contents of the upload directory without appropriate permissions. The issue has been addressed, and users are advised to upgrade.

Recommendations For PrestaShop versions prior to 1.7.8.8, upgrade to version 1.7.8.8 to resolve the issue. As a temporary workaround, consider restricting access to the upload directory until the upgrade is applied.

Exploit

Fix

Information Disclosure

Missing Authorization

Weakness Enumeration

CWE-200

CWE-862

Related Identifiers

CVE-2022-46158

GHSA-9QGP-9WWC-V29R

Affected Products

Prestashop

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/46xxx/CVE-2022-46158.json · Exploit
• https://github.com/PrestaShop/PrestaShop/commit/8684d429fb7c3bb51efb098e8b92a1fd2958f8cf · Patch
• https://osv.dev/vulnerability/GHSA-9qgp-9wwc-v29r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-46158 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46158 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-9qgp-9wwc-v29r · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.8.8 · Note
• https://t.me/cibsecurity/54205 · Telegram Post
• https://t.me/cvenotify/39491 · Telegram Post