Lucene search

GitHub Advisory DatabaseGHSA-3366-9287-7QPR

HistoryFeb 21, 2024 - 12:04 a.m.

Path disclosure in JavaScript variable

2024-02-2100:04:24

CWE-22

GitHub Advisory Database

github.com

javascript

path disclosure

variable

prestashop

owasp

github

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

15.5%

JSON

Impact

Path disclosure in JavaScript variable

Patches

Patch in PrestaShop 8.1.4

References

https://owasp.org/www-community/attacks/Full_Path_Disclosure

Thanks to https://github.com/hugo-fasone

Affected configurations

Vulners

Node

prestashopprestashopRange8.1.0–8.1.4

VendorProductVersionCPE
prestashopprestashop*cpe:2.3:a:prestashop:prestashop:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
prestashop	prestashop	*	cpe:2.3:a:prestashop:prestashop::::::::

References

github.com/advisories/GHSA-3366-9287-7qpr

github.com/PrestaShop/PrestaShop/commit/444bd0dea581659918fe2067541b9863cf099dd5

github.com/PrestaShop/PrestaShop/security/advisories/GHSA-3366-9287-7qpr

nvd.nist.gov/vuln/detail/CVE-2024-26129

owasp.org/www-community/attacks/Full_Path_Disclosure

CVSS3

5.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

AI Score

6.7

Confidence

High

EPSS

Percentile

15.5%

JSON

Related for GHSA-3366-9287-7QPR