Remote Code Execution in Adobe Stock API Integration for PrestaShop
CVE-2019-19595

9.8CRITICAL

Key Information:

Vendor: Adobe
Status: Stock Api Integration; Prestashop
Vendor: CVE Published:; 5 December 2019

Summary

The Adobe Stock API integration version 4.8 for PrestaShop contains a vulnerability that allows remote attackers to execute arbitrary code. This occurs via an improper handling of file uploads at reset/modules/advanced_form_maker_edit/multiupload/upload.php, where a malicious user can upload a .php file that is improperly processed, leading to unauthorized code execution.

References

https://ia-informatica.com/it/CVE-2019-19595

x_refsource_MISC

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Dec 5, 2019
Vulnerability Reserved
Dec 5, 2019