GHSA-M9R4-3FG7-PQM2 PrestaShop path traversal

Impact In the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path, using traversal path. Patches 8.1.1 Found by Aleksey Solovev Positive Technologies Workarounds none References none...

CVE-2023-39529

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

CVE-2023-39530

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

Code injection

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

CVE-2023-39530 PrestaShop vulnerable to file deletion via CustomerMessage

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

CVE-2023-39530 PrestaShop vulnerable to file deletion via CustomerMessage

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

CVE-2023-39530

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

CVE-2023-39530

PrestaShop prior to 8.1.1 is affected by a vulnerability in the CustomerMessage API that allows deletion of server-side files. Root cause aligns with an input validation issue enabling file deletion. Impact is high (integrity/availability affected) as described in multiple advisories; exploitatio...

CVE-2023-39530 PrestaShop vulnerable to file deletion via CustomerMessage

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

CVE-2023-39529 PrestaShop vulnerable to file deletion via attachment API

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

CVE-2023-39529

PrestaShop prior to version 8.1.1 is vulnerable to an issue where a file on the server can be deleted through the Attachments controller and the Attachments API. The root cause is an improper handling in the attachments logic that permits deletion of server files. Version 8.1.1 contains a patch t...

CVE-2023-39529 PrestaShop vulnerable to file deletion via attachment API

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

CVE-2023-39529

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

CVE-2023-39529 PrestaShop vulnerable to file deletion via attachment API

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

CVE-2023-39530: Improper Input Validation

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete files from the server via the CustomerMessage API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...

PT-2023-27000

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 8.1.1 Description The issue allows an attacker to delete a file from the server by utilizing the Attachments controller and the Attachments API. There are no known workarounds for this issue. Recommendations For...

CVE-2023-39525: Improper Limitation of a Pathname to a Restricted Directory

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, in the back office, files can be compromised using path traversal by replaying the import file deletion query with a specified file path that uses the traversal path. Version 8.1.1 contains a patch for this issue...

PT-2023-27001 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.1.1 Description: The issue allows deletion of files from the server via the CustomerMessage API. There are no known workarounds for this problem. Recommendations: For versions prior to 8.1.1, update to version...

PrestaShop 输入验证错误漏洞

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. An input validation error vulnerability exists in versions of PrestaShop prior to...

CVE-2023-39529: Improper Input Validation

PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, it is possible to delete a file from the server by using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue. There are no known workarounds...