PT-2023-27000 · Unknown · Prestashop

Kto94 · Published 2023-08-07 · Updated 2024-03-06 · CVE-2023-39529

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.1

Description The issue allows an attacker to delete a file from the server by utilizing the Attachments controller and the Attachments API. There are no known workarounds for this issue.

Recommendations For PrestaShop versions prior to 8.1.1, update to version 8.1.1 to resolve the issue. As a temporary workaround, consider restricting access to the Attachments controller and the Attachments API until the update is applied.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BIT-PRESTASHOP-2023-39529

CVE-2023-39529

GHSA-2RF5-3FW8-QM47

Affected Products

Prestashop

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39529.json · Exploit
• https://github.com/PrestaShop/PrestaShop/commit/b08c647305dc1e9e6a2445b724d13a9733b6ed82 · Patch
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-2rf5-3fw8-qm47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39529 · Security Note
• https://osv.dev/vulnerability/BIT-prestashop-2023-39529 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2rf5-3fw8-qm47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39529 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://t.me/cibsecurity/67930 · Telegram Post
• https://t.me/cvenotify/55961 · Telegram Post