PT-2023-28909 · Unknown · Prestashop

Jolelievre · Published 2023-09-28 · Updated 2024-03-06 · CVE-2023-43664

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.2

Description The issue concerns the PrestaShop Back office interface, where an employee can list all modules without any access rights due to the method ajaxProcessGetPossibleHookingListForModule not checking access rights. This issue has been addressed in a commit included in version 8.1.2.

Recommendations For versions prior to 8.1.2, upgrade to version 8.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the ajaxProcessGetPossibleHookingListForModule method until the upgrade is applied.

Exploit

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BIT-PRESTASHOP-2023-43664

CVE-2023-43664

GHSA-GVRG-62JP-RF7J

Affected Products

Prestashop

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43664.json · Exploit
• https://github.com/PrestaShop/PrestaShop/commit/15bd281c18f032a5134a8d213b44d24829d45762 · Patch
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gvrg-62jp-rf7j · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gvrg-62jp-rf7j · Vendor Advisory
• https://osv.dev/vulnerability/BIT-prestashop-2023-43664 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43664 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43664 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop · Note
• https://twitter.com/VulmonFeeds/status/1707496071276970256 · Twitter Post
• https://twitter.com/CVEnew/status/1707464961440559448 · Twitter Post
• https://t.me/cibsecurity/71225 · Telegram Post