High severity · published Nov 8, 2023
CVE-2023-47109
PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BL
blockreassurance · PrestaShop
<= 5.1.3 · source: vendor
CR
Customer Reassurance Block · Prestashop
before 5.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47109
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47109
Patch
https://github.com/PrestaShop/blockreassurance/commit/2d0e97bebf795690caffe33c1ab23a9bf43fcdfa
Patch
https://github.com/PrestaShop/blockreassurance/commit/eec00da564db4c1804b0a0d1e3d9f7ec4e27d823
Release Notes
https://github.com/PrestaShop/blockreassurance/releases/tag/v5.1.4
Vendor Advisory
https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-83j2-qhx2-p7jc
More from blockreassurance
5.3
CVE-2023-47110
Any value can be changed in the configuration table by an employee having access to block reassurance module
