PT-2024-40043 · Unknown · Legacy Shop Module

Published 2024-05-15 · Updated 2024-05-15

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Legacy shop module (affected versions not specified)

Description The issue concerns a vulnerability in the Legacy shop module where a backend editor can perform object injection in discount rules. This requires backend access and permission to edit discount rules. Although object injection is a serious issue, the need for specific permissions limits the potential exploiters, typically to administrators.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

GHSA-39J2-4P9J-5W4J

Affected Products

Legacy Shop Module

References · 4

• https://osv.dev/vulnerability/GHSA-39j2-4p9j-5w4j · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/ezsystems/ezpublish-legacy/2020-10-05-1.yaml · Note
• https://github.com/ezsystems/ezpublish-legacy · Note
• https://ezplatform.com/security-advisories/ibexa-sa-2020-006-object-injection-in-legacy-shop-module · Note