CVE-2023-3031: Prestahop module King-Avis - Path traversal
Published Jun 2, 2023
·Updated
Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.
Affected Software
1 affected component
Webbax King-avis Prestashop<17.3.15
Event History
Jun 2, 2023
CVE Published
via MITRE·12:42 PM
Data Sourced
via MITRE·12:42 PM
DescriptionSeverityWeakness
Data Sourced
01:15 PM
Description
Data Sourced
via NVD·01:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-3031.
2
What software is affected by this vulnerability?
The King-Avis module for Prestashop is affected by this vulnerability.
3
What is the severity of CVE-2023-3031?
The severity of CVE-2023-3031 is medium with a CVSS score of 4.9.
4
How can an attacker exploit this vulnerability?
An attacker with knowledge of the download token can exploit this vulnerability through a path traversal attack to read arbitrary local files.
5
How can I fix the CVE-2023-3031 vulnerability?
To fix the CVE-2023-3031 vulnerability, update the King-Avis module to version 17.3.15 or later.