GitHub Advisoryadvisory · Packagist

GHSA-v4gr-v679-42p7 PrestaShop file deletion via CustomerMessage

MEDIUM Published 2023-08-09 Modified 2023-08-09 Official page ↗
Aliases
CVE-2023-39530
Ecosystem
Packagist
Packages
prestashop/prestashop
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weaknesses
CWE-20
Reviewed
2023-08-09

Affected packages

• Packagist prestashop/prestashop: < 8.1.1 → fixed in 8.1.1

Description

Impact It is possible to delete files from the server via the CustomerMessage API Patches 8.1.1 Found by Kto94 (via Yeswehack) Workarounds none References none

Related

Alias · CVE (1)

  • CVE-2023-39530 PrestaShop is an open source e-commerce web application. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References