PT-2023-26996 · Unknown · Prestashop

Aleksey Solovev · Published 2023-08-07 · Updated 2024-03-06 · CVE-2023-39525

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.1

Description The issue allows files to be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path in the back office. There are no known workarounds.

Recommendations For PrestaShop versions prior to 8.1.1, update to version 8.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the import file deletion query to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BIT-PRESTASHOP-2023-39525

CVE-2023-39525

GHSA-M9R4-3FG7-PQM2

Affected Products

Prestashop

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39525.json · Exploit
• https://github.com/PrestaShop/PrestaShop/commit/c7c9a5110421bb2856f4d312ecce192d079b5ec7 · Patch
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-m9r4-3fg7-pqm2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m9r4-3fg7-pqm2 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-prestashop-2023-39525 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39525 · Security Note
• https://osv.dev/vulnerability/CVE-2023-39525 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://t.me/cvenotify/55965 · Telegram Post
• https://t.me/cibsecurity/67922 · Telegram Post