Critical severity · published Aug 7, 2023
CVE-2023-39526
PrestaShop is an open source e-commerce web application
9.8
CVSS
1.7%
EPSS
No
On KEV
Description
PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patch. There are no known workarounds.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 77% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Prestashop · Prestashop
before 1.7.8.10; 8.0.0 before 8.0.5; 8.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-39526
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-39526
Patch
https://github.com/PrestaShop/PrestaShop/commit/817847e2347844a9b6add017581f1932bcd28c09
Vendor Advisory
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gf46-prm4-56pc
More from Prestashop
9.9
CVE-2023-30838
PrestaShop is an Open Source e-commerce web application
9.8
CVE-2023-39524
PrestaShop is an open source e-commerce web application
9.8
CVE-2022-31181
Remote code execution in prestashop
9.8
CVE-2022-21686
PrestaShop is an Open Source e-commerce platform
9.8
CVE-2021-43789
PrestaShop is an Open Source e-commerce web application