PT-2024-13851 · Prestashop · Prestashop M4 Pdf Extensions Module

Published 2024-06-24 · Updated 2024-07-03 · CVE-2023-50029

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop M4 PDF Extensions module versions up to 3.3.2

Description The issue allows attackers to run arbitrary code via the M4PDF::saveTemplate() method, potentially leading to code injection attacks. This could enable malicious activities, such as unauthorized data access or modification.

Recommendations For PrestaShop M4 PDF Extensions module versions up to 3.3.2, consider disabling the M4PDF::saveTemplate() method until a patch is available to prevent potential code injection attacks. Restrict access to the module to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2023-50029

Affected Products

Prestashop M4 Pdf Extensions Module

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2023-50029 · Security Note
• https://security.friendsofpresta.org/modules/2024/06/20/m4pdf.html · Note
• https://t.me/cvenotify/84263 · Telegram Post