m4pdf- PrestaShop module vulnerability (CVE-2022-45448)
Modulem4pdf
Score
6.1 MediumDate publish
20-09-2023Versiones afectadas
- Up to and including 3.2.3
Description
M4 PDF plugin for Prestashop sites, in its 3.2.3 version and before, is vulnerable to an arbitrary HTML Document crafting vulnerability. The resource /m4pdf/pdf.php uses templates to dynamically create documents. In the case that the template does not exist, the application will return a fixed document with a message in mpdf format. An attacker could exploit this vulnerability by inputting a valid HTML/CSS document as the value of the parameter.References
Metrics
| cvssMetricV31 | |||||
|---|---|---|---|---|---|
| source | cve-coordination@incibe.es | nvd@nist.gov | |||
| type | Secondary | Primary | |||
| version | 3.1 | 3.1 | |||
| vectorString | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N | |||
| baseScore | 3.5 | 6.1 | |||
| baseSeverity | LOW | MEDIUM | |||
| attackVector | NETWORK | NETWORK | |||
| attackComplexity | LOW | LOW | |||
| privilegesRequired | LOW | NONE | |||
| userInteraction | REQUIRED | REQUIRED | |||
| scope | UNCHANGED | CHANGED | |||
| confidentialityImpact | NONE | LOW | |||
| integrityImpact | LOW | LOW | |||
| availabilityImpact | NONE | NONE | |||
| exploitabilityScore | 2.1 | 2.8 | |||
| impactScore | 1.4 | 2.7 | |||