Paper/Archive/CVE-2023-50029

CVE-2023-50029

prestashop m4_pdf — PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attacke…

EPSS 0.8%CVSS 10.0

critical.is priorityof 100

CVSS 10.0 (ADP)10.0 / 10 × 3030.0 Not in CISA KEV+300.0 EPSS percentile 56.3.563 × 2011.3 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

PHP Injection vulnerability in the module "M4 PDF Extensions" (m4pdf) up to version 3.3.2 from PrestaAddons for PrestaShop allows attackers to run arbitrary code via the M4PDF::saveTemplate() method.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

m4_pdf≤ 3.3.1–CISA-ADP

Scores by source

CISA ADP10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refsecurity.friendsofpresta.org/modules/2024/06/20/m4pdf.html