Critical severity · published Jun 24, 2024
CVE-2023-50029
PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the…
10.0
CVSS
0.8%
EPSS
No
On KEV
Description
PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate() method.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
M4 Pdf · Prestashop
through 3.3.1 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-50029
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-50029
security.friendsofpresta.org
https://security.friendsofpresta.org/modules/2024/06/20/m4pdf.html
More from M4 Pdf
6.5
CVE-2022-45447
Path Traversal in M4 PDF plugin for Prestashop sites
6.1
CVE-2022-45448
Cross-site Scripting in M4 PDF plugin for Prestashop sites