PT-2022-8645 · Unknown · Prestashop

P1Nk15Amako · Published 2022-07-13 · Updated 2022-07-25 · CVE-2020-21967

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Prestashop version 1.7.6.7

Description The issue allows remote attackers to run arbitrary code via the add new file page in the Catalog feature. This is a file upload vulnerability that can be exploited by attackers.

Recommendations For Prestashop version 1.7.6.7, consider disabling the file upload feature in the Catalog until a patch is available to prevent remote attackers from running arbitrary code.

Exploit

Fix

RCE

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-21967

Affected Products

Prestashop

References · 8

• 🔥 https://github.com/PrestaShop/PrestaShop/issues/20306 · Exploit
• 🔥 http://packetstormsecurity.com/files/167742/PrestaShop-1.7.6.7-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-21967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-21967 · Security Note
• https://t.me/cvenotify/33062 · Telegram Post
• https://t.me/cvenotify/33722 · Telegram Post
• https://t.me/cvenotify/33016 · Telegram Post
• https://t.me/cibsecurity/46216 · Telegram Post