CVE-2023-27032

Опубликовано: 12 апр. 2023

Источник: nvd

CVSS3: 9.8

EPSS Средний

Описание

Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::getPopups().

Ссылки

https://addons.prestashop.com/en/pop-up/23773-popup-on-entry-exit-popup-add-product-and-newsletter.html
Product
https://friends-of-presta.github.io/security-advisories/modules/2023/04/11/advancedpopupcreator.html
Patch
Third Party Advisory
https://addons.prestashop.com/en/pop-up/23773-popup-on-entry-exit-popup-add-product-and-newsletter.html
Product
https://friends-of-presta.github.io/security-advisories/modules/2023/04/11/advancedpopupcreator.html
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:idnovate:popup_module_\(on_entering\,_exit_popup\,_add_product\)_and_newsletter:*:*:*:*:*:prestashop:*:*

Версия от 1.1.21 (включая) до 1.1.25 (исключая)

EPSS

Процентиль: 98%

0.4769

Средний

9.8 Critical

CVSS3

Дефекты

CWE-89

Связанные уязвимости

GHSA-m963-5mrx-529j