CVE-2023-39528
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
PrestaShop prior to version 8.1.1 contained the `displayAjaxEmailHTML` method that could be exploited to read any file on the server, potentially even outside of the project if the server is not correctly configured.
Risk Assessment
Organizations may be exposed to unauthorized access to sensitive data on the server, potentially leading to serious security breaches.
Recommendation
It is recommended to upgrade to version 8.1.1 or later to patch this vulnerability.
Original NVD description (English source)
PrestaShop is an open source e-commerce web application. Prior to version 8.1.1, the `displayAjaxEmailHTML` method can be used to read any file on the server, potentially even outside of the project if the server is not correctly configured. Version 8.1.1 contains a patch for this issue. There are no known workarounds.