Lucene search

MitreCVE-2023-45384

HistoryOct 19, 2023 - 1:15 p.m.

CVE-2023-45384

2023-10-1913:15:10

CWE-434

mitre

web.nvd.nist.gov

knowband supercheckout

vulnerability

cve-2023-45384

unrestricted upload

dangerous file type

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

43.8%

JSON

KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module “Module One Page Checkout, Social Login & Mailchimp” (supercheckout), a guest can upload files with extensions .php

Affected configurations

Nvd

Node

knowbandsupercheckoutRange5.0.7–6.0.7prestashop

VendorProductVersionCPE
knowbandsupercheckout*cpe:2.3:a:knowband:supercheckout:*:*:*:*:*:prestashop:*:*

Vendor	Product	Version	CPE
knowband	supercheckout	*	cpe:2.3:a:knowband:supercheckout::::::prestashop::*

References

addons.prestashop.com/fr/processus-rapide-commande/18016-one-page-checkout-social-login-mailchimp.html

security.friendsofpresta.org/modules/2023/10/17/supercheckout.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.001

Percentile

43.8%

JSON

Related for CVE-2023-45384