High severity · published Nov 8, 2023
CVE-2023-47109
PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy
8.1
CVSS
0.8%
EPSS
No
On KEV
Description
PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Customer Reassurance Block · Prestashop
before 5.1.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-47109
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-47109
Patch
https://github.com/PrestaShop/blockreassurance/commit/2d0e97bebf795690caffe33c1ab23a9bf43fcdfa
Patch
https://github.com/PrestaShop/blockreassurance/commit/eec00da564db4c1804b0a0d1e3d9f7ec4e27d823
Release Notes
https://github.com/PrestaShop/blockreassurance/releases/tag/v5.1.4
Vendor Advisory
https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-83j2-qhx2-p7jc
More from Customer Reassurance Block
5.3
CVE-2023-47110
blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy
