PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block

CAO 8.1CVE-2023-47109 · GHSA-83j2-qhx2-p7jc · Công bố 08/11/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-47109 là lỗ hổng mức CAO (CVSS 8.1) ảnh hưởng prestashop/blockreassurance, customer reassurance block (prestashop).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.77%, cao hơn 55.7% các lỗ hổng khác.
Cách xử lý: cập nhật lên 5.1.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
prestashop/blockreassurance Packagist	`< 5.1.4`	`5.1.4`
customer reassurance block prestashop	`< 5.1.4`	`5.1.4`

Mô tả

Impact

When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted.

It is possible to make the website completely unavailable by removing index.php for example.

Patches

v5.1.4

Workarounds

No workaround available

References

Mô tả của NVD

PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.