Lucene search

MitreCVE-2023-30281

HistoryMay 16, 2023 - 8:15 p.m.

CVE-2023-30281

2023-05-1620:15:09

mitre

web.nvd.nist.gov

cve-2023-30281

insecure permissions

vulnerability

store commander

prestashop

personal information leak

nvd

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

23.8%

JSON

Insecure permissions vulnerability was discovered, due to a lack of permissions’s control in scquickaccounting before v3.7.3 from Store Commander for PrestaShop, a guest can access exports from the module which can lead to leak of personnal informations from ps_customer table sush as name / surname / email

Affected configurations

Nvd

Node

storecommanderscquickaccountingRange<3.7.3prestashop

VendorProductVersionCPE
storecommanderscquickaccounting*cpe:2.3:a:storecommander:scquickaccounting:*:*:*:*:*:prestashop:*:*

Vendor	Product	Version	CPE
storecommander	scquickaccounting	*	cpe:2.3:a:storecommander:scquickaccounting::::::prestashop::*

References

friends-of-presta.github.io/security-advisories/modules/2023/05/04/scquickaccounting.html

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.001

Percentile

23.8%

JSON

Related for CVE-2023-30281