CVE-2023-47109 json
PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block
published 2023-11-08 3 y ago modified 2026-09-10 1 mo ago also GHSA-83j2-qhx2-p7jc , EUVD-2023-2915
- cvss
- 5.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.8%
- EPSS 0.8% chance of exploitation in 30 days, percentile 55%
- public exploits
- 0
- none known
Summary
PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.
Patch / fix
- packagist prestashop/blockreassurance 5.1.4
- prestashop customer_reassurance_block 5.1.4
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.77% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
| GitHub | 3.1 | 5.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | prestashop/blockreassurance | <5.1.4 |
5.1.4 |
Affected products
- PrestaShop blockreassurance
Classification
- Weakness
-
- CWE-285 Improper Authorization
References
-
github.com
/PrestaShop/blockreassurance/commit/2d0e97bebf795690caffe33c1ab23a9bf43fcdfa
web, patch
-
github.com
/PrestaShop/blockreassurance/commit/eec00da564db4c1804b0a0d1e3d9f7ec4e27d823
web, patch
-
github.com
/PrestaShop/blockreassurance/security/advisories/GHSA-83j2-qhx2-p7jc
web, vendor-advisory
-
github.com
/PrestaShop/blockreassurance/releases/tag/v5.1.4
web, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2023-47109
advisory
-
github.com
/PrestaShop/blockreassurance
package
Sources
- CVE List CVE-2023-47109
- GitHub Advisory GHSA-83j2-qhx2-p7jc
- NVD CVE-2023-47109
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.