CVE-2023-39525

MEDIUM6.5EPSS 1.3%

PrestaShop path traversal

Published: 8/9/2023Modified: 2/16/2024

Also known as:GHSA-m9r4-3fg7-pqm2BIT-prestashop-2023-39525

Description

### Impact In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path. ### Patches 8.1.1 ### Found by Aleksey Solovev (Positive Technologies) ### Workarounds none ### References none

Affected packages (2)

Bitnami/prestashopfrom 0, < 8.1.1
Packagist/prestashop/prestashopfrom 0, < 8.1.1

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

References (4)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2023-39525
PATCHhttps://github.com/PrestaShop/PrestaShop
WEBhttps://github.com/PrestaShop/PrestaShop/commit/c7c9a5110421bb2856f4d312ecce192d079b5ec7
WEBhttps://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-m9r4-3fg7-pqm2