prestashop/blockreassurance · Security
Any value can be changed in the configuration table by an employee having access to block reassurance module
- GHSA ID
- GHSA-xfm3-hjcc-gv78
- CVE ID
- CVE-2023-47110
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Description
Impact
An ajax function in module blockreassurance allows modifying any value in the configuration table
Patches
v5.1.4
Workarounds
no workaround available
References
CWEs
- CWE-284 · Improper Access Control
References
- https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-xfm3-hjcc-gv78 ↗
- https://github.com/PrestaShop/blockreassurance/commit/0a74bf1ebb907eef39e235a3a6dca0c28ed3ad23 ↗
- https://github.com/PrestaShop/blockreassurance/releases/tag/v5.1.4 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2023-47110 ↗
- https://github.com/advisories/GHSA-xfm3-hjcc-gv78 ↗