CVE-2024-26129 Prestashop vulnerable to path disclosure in JavaScript variable
Attackers can obtain sensitive file path information from a JavaScript variable in PrestaShop, potentially aiding further attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26129?
CVE-2024-26129 is a medium-severity vulnerability in Prestashop Prestashop, published on 19 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.
Weakness: CWE-22
Which versions are affected by CVE-2024-26129?
2 open source packages ship an affected version, including prestashop/prestashop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
prestashop/prestashop Packagist | From 8.1.0 | 8.1.4 |
prestashop/prestashop Packagist | From 8.1.0 | 8.1.4 |
Products include Prestashop Prestashop.
How do I fix CVE-2024-26129?
Upgrade prestashop/prestashop to 8.1.4 or later.
Is CVE-2024-26129 being exploited?
There is no known exploitation of CVE-2024-26129 in the wild and no public exploit code.
Other vulnerabilities in Prestashop Prestashop
Sources
Also known as GHSA-3366-9287-7qpr.