CVE-2023-27033

Опубликовано: 07 апр. 2023

Источник: nvd

CVSS3: 9.8

EPSS Низкий

Описание

Prestashop cdesigner v3.1.3 to v3.1.8 was discovered to contain a code injection vulnerability via the component CdesignerSaverotateModuleFrontController::initContent().

Ссылки

https://addons.prestashop.com/fr/declinaisons-personnalisation/22677-personnalisation-de-produit-product-customize.html
Product
https://friends-of-presta.github.io/security-advisories/modules/2023/04/06/cdesigner-CWE434.html
Exploit
Patch
Third Party Advisory
https://addons.prestashop.com/fr/declinaisons-personnalisation/22677-personnalisation-de-produit-product-customize.html
Product
https://friends-of-presta.github.io/security-advisories/modules/2023/04/06/cdesigner-CWE434.html
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:cdesigner_project:cdesigner:*:*:*:*:*:prestashop:*:*

Версия от 3.1.3 (включая) до 3.2.2 (исключая)

EPSS

Процентиль: 33%

0.00131

Низкий

9.8 Critical

CVSS3

Дефекты

CWE-434

Связанные уязвимости

GHSA-mq78-wwwr-738x