CVE-2024-26129: Prestashop vulnerable to path disclosure in JavaScript variable
Impact Path disclosure in JavaScript variable
Patches Patch in PrestaShop 8.1.4
References https://owasp.org/www-community/attacks/FullPathDisclosure
Thanks to https://github.com/hugo-fasone
Other sources
PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/prestashop/prestashopto a version that resolves this vulnerability.Fixed in 8.1.4 - Upgrade
Upgrade
PrestaShopto a version that resolves this vulnerability.Fixed in 8.1.4 - Compensating control
If you cannot upgrade immediately, mitigate path disclosure by removing or masking sensitive path information exposed in JavaScript variables (as described under Full Path Disclosure).
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26129?
CVE-2024-26129 has not been explicitly assigned a severity rating, but it involves path disclosure which could expose sensitive information.
How do I fix CVE-2024-26129?
To fix CVE-2024-26129, upgrade to PrestaShop version 8.1.4 or later.
What causes CVE-2024-26129?
CVE-2024-26129 is caused by improper handling of JavaScript variables leading to path disclosure.
What versions of PrestaShop are affected by CVE-2024-26129?
PrestaShop versions from 8.1.0 to 8.1.3 are affected by CVE-2024-26129.
Is CVE-2024-26129 related to any specific attacks?
CVE-2024-26129 is related to path disclosure attacks that can reveal server file paths.