CVE-2022-46158

Katalog CVE

CVSS 4.3 · Medium EPSS 0,50%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada prestashop. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to upgrade to version 1.7.8.8. There are no known workarounds for this issue.

Rincian

Terbit di NVD

8 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-862: Missing Authorization

EPSS (30 hari)

0,50% peluang dieksploitasi; lebih tinggi dari 40,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/PrestaShop/PrestaShop/commit/8684d429fb7c3bb51efb098e8b92a1fd2958f8cf patch · advisory pihak ketiga
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-9qgp-9wwc-v29r advisory pihak ketiga