CVE-2023-30545 PrestaShop arbitrary file read vulnerability

2023-04-2517:47:01

CWE-89

GitHub_M

www.cve.org

prestashop

vulnerability

file read

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

45.4%

JSON

PrestaShop is an Open Source e-commerce web application. Prior to versions 8.0.4 and 1.7.8.9, it is possible for a user with access to the SQL Manager (Advanced Options -> Database) to arbitrarily read any file on the operating system when using SQL function LOAD_FILE in a SELECT request. This gives the user access to critical information. A patch is available in PrestaShop 8.0.4 and PS 1.7.8.9

CNA Affected

[
  {
    "vendor": "PrestaShop",
    "product": "PrestaShop",
    "versions": [
      {
        "version": "< 1.7.8.9",
        "status": "affected"
      },
      {
        "version": ">= 8.0.0, < 8.0.4",
        "status": "affected"
      }
    ]
  }
]