CVE-2024-36682: High severity promokit.eu theme settings vulnerability
In the module "Theme settings" (pkthemesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email when maintenance is enable which can lead to leak of personal information.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36682?
CVE-2024-36682 is considered a medium severity vulnerability due to unauthorized access to sensitive email data.
How do I fix CVE-2024-36682?
To fix CVE-2024-36682, update the Theme settings module to version 1.8.9 or later to ensure proper permissions are enforced.
Who is affected by CVE-2024-36682?
CVE-2024-36682 affects users of the Theme settings module version 1.8.8 and earlier in PrestaShop installations.
What is the impact of CVE-2024-36682?
The impact of CVE-2024-36682 is that unauthorized guests can download stored emails while the shop is in maintenance mode.
Is CVE-2024-36682 a common vulnerability?
While not extremely common, CVE-2024-36682 highlights a specific issue in permission controls that can affect many PrestaShop users.