CVE-2024-25840

2024-02-2700:00:00

mitre

github.com

cve-2024-25840

account manager

sales representative

dealers

crm

presta world

path traversal attack

security vulnerability

guest access

AI Score

6.7

Confidence

Low

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

In the module “Account Manager | Sales Representative & Dealers | CRM” (prestasalesmanager) up to 9.0 from Presta World for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:prestaworld:prestasalesmanager:*:*:*:*:*:*:*:*"
    ],
    "vendor": "prestaworld",
    "product": "prestasalesmanager",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "9.0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]