PT-2023-29539 · Unknown · Prestashop+1

Published 2023-11-17 · Updated 2024-08-12 · CVE-2023-45382

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions SoNice Retour module for PrestaShop versions up to 2.1.0

Description The issue allows a guest to download personal information without restriction by performing a path traversal attack. This is due to a lack of permissions control and a lack of control in the path name construction, enabling a guest to view all files on the information system.

Recommendations For SoNice Retour module for PrestaShop versions up to 2.1.0, consider disabling the module until a patch is available to prevent path traversal attacks. Restrict access to sensitive files and directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-45382

Affected Products

Prestashop

Sonice Retour

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2023-45382 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45382 · Vendor Advisory
• https://security.friendsofpresta.org/modules/2023/11/16/sonice_retour.html · Note
• https://common-services.com/fr/home-fr · Note
• https://t.me/cvenotify/90079 · Telegram Post