CVE-2023-47110
Assigner: GitHub_M
Published: 2023-11-09T15:24:15.247Z
State: PUBLISHED
title: Any value can be changed in the configuration table by an employee having access to block reassurance module 
problemTypes: descriptions: cweId: CWE-284
description: CWE-284: Improper Access Control
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H
version: 3.1
affected: vendor: PrestaShop
product: blockreassurance
versions: version: <= 5.1.3
status: affected
descriptions: value: blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in module blockreassurance allows modifying any value in the configuration table. This vulnerability has been patched in version 5.1.4.
source: advisory: GHSA-xfm3-hjcc-gv78
discovery: UNKNOWN