Vulnerability · Published Nov 8, 2023 · Assigned by GitHub_M
CVE-2023-47109PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block
Medium 5.5
In plain English
A medium-severity security flaw in blockreassurance from PrestaShop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | prestashop/blockreassurance | 5.1.4 | GHSA-83j2-qhx2-p7jc |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PrestaShop | blockreassurance | <= 5.1.3 |
Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H
References
- https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-83j2-qhx2-p7jc x_refsource_CONFIRM
- https://github.com/PrestaShop/blockreassurance/commit/2d0e97bebf795690caffe33c1ab23a9bf43fcdfa x_refsource_MISC
- https://github.com/PrestaShop/blockreassurance/commit/eec00da564db4c1804b0a0d1e3d9f7ec4e27d823 x_refsource_MISC
- https://github.com/PrestaShop/blockreassurance/releases/tag/v5.1.4 x_refsource_MISC