PT-2024-22414 · Unknown · Advanced Plugins Reportsstatistics

Published 2024-03-19 · Updated 2024-10-28 · CVE-2024-28394

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advanced Plugins reportsstatistics versions 1.3.20 and earlier

Description An issue in Advanced Plugins reportsstatistics allows a remote attacker to execute arbitrary code via the Sales Reports, Statistics, Custom Fields & Export module.

Recommendations For versions 1.3.20 and earlier, update to a version later than 1.3.20 to resolve the issue. As a temporary workaround, consider disabling the Sales Reports, Statistics, Custom Fields & Export module until a patch is available. Restrict access to the module to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2024-28394

Affected Products

Advanced Plugins Reportsstatistics

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-28394 · Security Note
• https://twitter.com/CVEnew/status/1770172787396628792 · Twitter Post
• https://security.friendsofpresta.org/modules/2024/03/14/reportsstatistics.html · Note
• https://t.me/cvenotify/99796 · Telegram Post
• https://addons.prestashop.com/en/customer-administration/28379-sales-reports-statistics-custom-fields-export.html · Note
• https://t.me/cvenotify/89254 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1770217669456707701 · Twitter Post