PT-2023-29537 · Prestashop · Order Duplicator Module

Published 2023-11-07 · Updated 2024-09-05 · CVE-2023-45380

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Order Duplicator module for PrestaShop versions <= 1.1.7

Description The issue allows a guest to download personal information without restriction due to a lack of permissions control. This includes accessing data from the ps customer and ps address tables, such as name, surname, phone number, and full postal address.

Recommendations For versions <= 1.1.7, update to a version greater than 1.1.7 to resolve the issue. As a temporary workaround, consider restricting access to the Order Duplicator module until a patch is available. Additionally, restrict access to the ps customer and ps address tables to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-45380

Affected Products

Order Duplicator Module

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-45380 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45380 · Vendor Advisory
• https://security.friendsofpresta.org/modules/2023/11/07/orderduplicate.html · Note
• https://twitter.com/VulmonFeeds/status/1722069528480203158 · Twitter Post