CVE-2023-3031
MediumCVSS 4.9Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
Improper limitation of a pathname leads to a Path Traversal vulnerability in the King-Avis module for Prestashop, allowing a user knowing the download token to read arbitrary local files. This issue affects King-Avis versions before 17.3.15.
Risk Assessment
This vulnerability may lead to unauthorized access to sensitive data on the server, posing a serious security threat to the organization.
Recommendation
It is recommended to update the King-Avis module to version 17.3.15 or later to mitigate this vulnerability.
Original NVD description (English source)
Improper Limitation of a Pathname leads to a Path Traversal vulnerability in the module King-Avis for Prestashop, allowing a user knowing the download token to read arbitrary local files.This issue affects King-Avis: before 17.3.15.