CVE-2024-26129

EUVD-2024-0476
PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 53%
Affected Products (NVD)
VendorProductVersion
prestashopprestashop
8.1.0 ≤
𝑥
< 8.1.4
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
prestashopprestashop
8.1.0 ≤
𝑥
< 8.1.4
ADP
Common Weakness Enumeration
References
https://github.com/PrestaShop/PrestaShop/commit/444bd0dea581659918fe2067541b9863cf099dd5
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3366-9287-7qpr
https://owasp.org/www-community/attacks/Full_Path_Disclosure
https://github.com/PrestaShop/PrestaShop/commit/444bd0dea581659918fe2067541b9863cf099dd5
https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3366-9287-7qpr
https://owasp.org/www-community/attacks/Full_Path_Disclosure