PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block
CVE-2023-47109

5.5MEDIUM

Key Information:

Vendor

Prestashop

Status
Blockreassurance
Vendor
CVE Published:
8 November 2023

What is CVE-2023-47109?

PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.

Affected Version(s)

blockreassurance <= 5.1.3

References

https://github.com/PrestaShop/blockreassurance/security/a...
x_refsource_CONFIRM
https://github.com/PrestaShop/blockreassurance/commit/2d0...
x_refsource_MISC
https://github.com/PrestaShop/blockreassurance/commit/eec...
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.