PT-2024-13662 · 202 Ecommerce+1 · 202 Ecommerce Advanced Loyalty Program: Loyalty Points+1

Published 2024-01-16 · Updated 2024-01-23 · CVE-2023-48926

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions 202 ecommerce Advanced Loyalty Program: Loyalty Points versions prior to 2.3.4 for PrestaShop

Description The issue allows unauthenticated attackers to arbitrarily change an order status.

Recommendations For versions prior to 2.3.4, update to version 2.3.4 or later to resolve the issue.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2023-48926

GHSA-JP2C-MJ65-QPMW

Affected Products

202 Ecommerce Advanced Loyalty Program: Loyalty Points

Prestashop

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-48926 · Security Note
• https://osv.dev/vulnerability/CVE-2023-48926 · Vendor Advisory
• https://github.com/202ecommerce/security-advisories/security/advisories/GHSA-jp2c-mj65-qpmw · Note
• https://twitter.com/CVEnew/status/1747369417132949965 · Twitter Post