PT-2024-25185 · Unknown · Fme Modules Customfields

Published 2024-04-30 · Updated 2024-09-06 · CVE-2024-33274

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FME Modules customfields versions 2.2.7 and before

Description A Directory Traversal issue allows a remote attacker to obtain sensitive information via the "Custom Checkout Fields, Add Custom Fields to Checkout" parameter of the "ajax.php" endpoint.

Recommendations For versions 2.2.7 and before, consider disabling the "ajax.php" endpoint or restricting access to the "Custom Checkout Fields, Add Custom Fields to Checkout" parameter until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2024-33274

Affected Products

Fme Modules Customfields

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-33274 · Security Note
• https://t.me/cvenotify/78604 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1785353471698272275 · Twitter Post
• https://addons.prestashop.com/en/registration-ordering-process/19008-custom-checkout-fields-add-custom-fields-to-checkout.html · Note
• https://twitter.com/CVEnew/status/1785321310702498219 · Twitter Post
• https://security.friendsofpresta.org/modules/2024/04/29/customfields.html · Note