PrestaShop vulnerable to path disclosure in JavaScript variable
CVE-2024-26129

5.3MEDIUM

Key Information:

Vendor

PrestaShop

Status
PrestaShop
Vendor
CVE Published:
19 February 2024

What is CVE-2024-26129?

PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.

Affected Version(s)

PrestaShop >= 8.1.0, < 8.1.4

References

https://github.com/PrestaShop/PrestaShop/security/advisor...
x_refsource_CONFIRM
https://github.com/PrestaShop/PrestaShop/commit/444bd0dea...
x_refsource_MISC
https://owasp.org/www-community/attacks/Full_Path_Disclosure
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.