PT-2023-22579 · Prestashop · Myinventory

Published 2023-05-31 · Updated 2025-01-09 · CVE-2023-30197

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop module myinventory versions 1.6.6 and earlier

Description The issue allows unauthorized access to personal information due to incorrect access control in the myinventory module. This can be exploited by a guest performing a path traversal attack, enabling them to download sensitive data without restrictions.

Recommendations For versions 1.6.6 and earlier, update the myinventory module to a version later than 1.6.6 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-30197

Affected Products

Myinventory

References · 4

• https://osv.dev/vulnerability/CVE-2023-30197 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-30197 · Security Note
• https://github.com/PrestaShop/PrestaShop/blob/6c05518b807d014ee8edb811041e3de232520c28/classes/Tools.php#L1247 · Note
• https://friends-of-presta.github.io/security-advisories/modules/2023/05/30/myinventory.html · Note