PT-2024-20353 · Linea Grafica · Multilingual/Multistore Sitemap Pro - Seo

Published 2024-02-07 · Updated 2024-02-14 · CVE-2024-24311

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for PrestaShop versions prior to 1.6.6

Description The issue allows a guest to download personal information without restriction due to a Path Traversal vulnerability. This vulnerability can be exploited by an unauthorized user to access sensitive data.

Recommendations For versions prior to 1.6.6, update to version 1.6.6 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update can be applied.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-24311

Affected Products

Multilingual/Multistore Sitemap Pro - Seo

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-24311 · Security Note
• https://security.friendsofpresta.org/modules/2024/02/06/lgsitemaps.html · Patch
• https://osv.dev/vulnerability/CVE-2024-24311 · Vendor Advisory
• https://t.me/cvenotify/71429 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1755192490234159534 · Twitter Post
• https://t.me/cvenotify/70365 · Telegram Post
• https://twitter.com/CVEnew/status/1755152605540446491 · Twitter Post