Skip to content
Fencer Intel
low —

GHSA-mqq7-wxx5-mp8h json

ps_checkout allows unauthorized method invocation through unvalidated parameter

published 6mo ago modified 2mo ago

cvss
—
not scored
cisa kev
Not listed
not in CISA's catalog
epss
—
no score, EPSS covers CVEs only
public exploits
0
none known

Summary

### Impact

Unvalidated parameter can lead to some unauthorized method invocation with very little possibilities.

### Patches

The problem has been patched in versions

- v5.3.0 for PrestaShop 1.7 (build number: 7.5.3.0) - v5.3.0 for PrestaShop 8 (build number: 8.5.3.0) - v5.3.0 for PrestaShop 9 (build number: 9.5.3.0)

Read the [Versioning policy](https://github.com/PrestaShopCorp/ps_checkout/wiki/Versioning) to learn more about the build numbers.

### Credits

PrestaShop thanks [PATICEO](https://www.paticeo.com/) for reporting the issue.

Patch / fix

  • packagist prestashop/ps_checkout 5.3.0

Is GHSA-mqq7-wxx5-mp8h in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem package affected fixed in
packagist prestashop/ps_checkout
<5.3.0
5.3.0

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.