CVE-2023-47109CWE-285

PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block

Medium · published November 8, 2023

CVSS v3.1
5.5
EPSS
1%
Percentile
55.2
In the wild
Unconfirmed
What it is

PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00771 · 55.2th percentile
Weakness
CWE-285 · Improper Authorization
Published
2023-11-08T21:37Z
EPSS history
Timeline
  • 08 NOV 21:37Z
    PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block
    cvelistv5