BIT-prestashop-2023-43664

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/prestashop/BIT-prestashop-2023-43664.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-prestashop-2023-43664

Withdrawn

2026-07-16T09:00:05Z

Published

2024-03-06T11:02:38Z

Modified

2026-07-16T09:11:45Z

Summary

Employee without any access rights can list all installed modules in Prestashop

Details

PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights. This issue has been addressed in commit 15bd281c which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue.

Database specific

{
    "cpes":  [
        "cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*"
    ],
    "severity":  "Medium"
}

References

Affected packages

Bitnami / prestashop

Package

Name: prestashop
Purl: pkg:bitnami/prestashop

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

8.1.2

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/prestashop/BIT-prestashop-2023-43664.json"