PrestaShop vulnerable to file reading through path traversal
CVE-2023-39528

6.8MEDIUM

Key Information:

Vendor

Prestashop

Status
Prestashop
Vendor
CVE Published:
7 August 2023

What is CVE-2023-39528?

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the displayAjaxEmailHTML method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.

Affected Version(s)

PrestaShop < 8.1.1

References

https://github.com/PrestaShop/PrestaShop/security/advisor...
x_refsource_CONFIRM
https://github.com/PrestaShop/PrestaShop/commit/11de3a843...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.