In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Due to a lack of permissions control and a lack of control in the path name construction, a guest can perform a path traversal to view all files on the information system.
References
Link | Resource |
---|---|
https://common-services.com/fr/home-fr/ | Product |
https://security.friendsofpresta.org/modules/2023/10/17/sonice_etiquetage.html | Patch Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2023-10-18T00:00:00
Updated: 2023-10-18T15:42:54.122798
Reserved: 2023-10-09T00:00:00
Link: CVE-2023-45383
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-10-18T16:15:08.853
Modified: 2023-10-25T01:24:51.267
Link: CVE-2023-45383
JSON object: View
Redhat Information
No data.
CWE