CVE-2022-46158 Potential Information exposure in the upload directory in PrestaShop
Attackers can view contents of the upload directory without proper permissions, exposing sensitive files in PrestaShop installations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-46158?
CVE-2022-46158 is a medium-severity vulnerability in Prestashop Prestashop, published on 8 Dec 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PrestaShop is an open-source e-commerce solution. Versions prior to 1.7.8.8 did not properly restrict host filesystem access for users. Users may have been able to view the contents of the upload directory without appropriate permissions. This issue has been addressed and users are advised to upgrade to version 1.7.8.8. There are no known workarounds for this issue.
Which versions are affected by CVE-2022-46158?
2 open source packages ship an affected version, including prestashop/prestashop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
prestashop/prestashop Packagist | All versions | 1.7.8.8 |
prestashop/prestashop Packagist | All versions | 1.7.8.8 |
Products include Prestashop Prestashop.
How do I fix CVE-2022-46158?
Upgrade prestashop/prestashop to 1.7.8.8 or later.
Is CVE-2022-46158 being exploited?
There is no known exploitation of CVE-2022-46158 in the wild and no public exploit code.
Other vulnerabilities in Prestashop Prestashop
Sources
Also known as GHSA-9qgp-9wwc-v29r.