GHSA-m9r4-3fg7-pqm2

ghsaUSosv

PrestaShop path traversal

view advisory published 2023-08-09Licence: CC-BY-4.0

### Impact In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path. ### Patches 8.1.1 ### Found by Aleksey Solovev (Positive Technologies) ### Workarounds none ### References none

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-39525US	critical9.1	0.86% (58th)	—	2023-08-07
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file dele…

references

External citations — patches, advisories, analysis.

https://github.com/PrestaShop/PrestaShopPACKAGE
https://github.com/PrestaShop/PrestaShop/commit/c7c9a5110421bb2856f4d312ecce192d079b5ec7WEB
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-m9r4-3fg7-pqm2WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-39525ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan