CVE-2023-43664

Katalog CVE

CVSS 4.3 · Medium EPSS 0,48%

Kerentanan Improper Privilege Management pada prestashop. Skor CVSS 3.1 4.3 (Medium) menurut NVD.

Deskripsi (NVD)

PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights. This issue has been addressed in commit `15bd281c` which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue.

Rincian

Terbit di NVD

28 September 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-269: Improper Privilege Management

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gvrg-62jp-rf7j advisory vendor
• https://github.com/PrestaShop/PrestaShop/commit/15bd281c18f032a5134a8d213b44d24829d45762 patch