CVE-2024-36682

2024-06-2400:00:00

mitre

github.com

module

theme

settings

promokit.eu

prestashop

unauthorized access

email collection

maintenance mode

permissions control

personal information

AI Score

6.8

Confidence

High

SSVC

Exploitation

none

Automatable

yes

Technical Impact

partial

JSON

In the module “Theme settings” (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email when maintenance is enable which can lead to leak of personal information.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:prestashopmodules:themesettings:*:*:*:*:*:*:*:*"
    ],
    "vendor": "prestashopmodules",
    "product": "themesettings",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "1.8.8"
      }
    ],
    "defaultStatus": "unknown"
  }
]