PT-2024-27126 · Prestashop+1 · Theme Settings+1
Published
2024-06-24
·
Updated
2024-08-01
·
CVE-2024-36682
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
PrestaShop module "Theme settings" (pk themesettings) versions <= 1.8.8
Description
The issue allows a guest to download a txt file containing collected email addresses when the shop is in maintenance mode, due to a lack of permissions control. This can lead to a leak of personal information.
Recommendations
For versions <= 1.8.8, consider disabling the maintenance mode or restricting access to the module "Theme settings" (pk themesettings) until a fix is available. As a temporary workaround, restrict access to the txt file that collects email addresses to minimize the risk of exploitation.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Prestashop
Theme Settings