Prestahop module King-Avis - Path traversal
CVE-2023-3031

4.9MEDIUM

Key Information:

Vendor

Webbax

Status
King-avis
Vendor
CVE Published:
2 June 2023

What is CVE-2023-3031?

Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.

Affected Version(s)

King-Avis 0 < 17.3.15

References

https://borelenzo.github.io/stuff/2023/06/01/cve-2023-303...

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

testeurdestylos
.