CVE-2023-43664: Employee without any access rights can list all installed modules in Prestashop
Impact In BO, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights
Patches Fixed on 8.1.2
Workarounds
References
Other sources
PrestaShop is an Open Source e-commerce web application. In the Prestashop Back office interface, an employee can list all modules without any access rights: method ajaxProcessGetPossibleHookingListForModule doesn't check access rights. This issue has been addressed in commit 15bd281c which is included in version 8.1.2. Users are advised to upgrade. There are no known workaround for this issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the impact of CVE-2023-43664?
In the PrestaShop Back office interface, an employee can list all modules without any access rights.
How can I fix CVE-2023-43664?
Update PrestaShop to version 8.1.2 or higher, which includes the fix for this vulnerability.
What is the severity of CVE-2023-43664?
The severity of CVE-2023-43664 is medium, with a CVSS score of 4.3.
What is the CWE number of CVE-2023-43664?
The CWE number of CVE-2023-43664 is 269.
Where can I find more information about CVE-2023-43664?
You can find more information about CVE-2023-43664 in the following references: [reference 1](https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-gvrg-62jp-rf7j), [reference 2](https://github.com/PrestaShop/PrestaShop/commit/15bd281c18f032a5134a8d213b44d24829d45762), [reference 3](https://github.com/advisories/GHSA-gvrg-62jp-rf7j).