« Volver al listado

CVE-2023-45384

Estado: ModificadaCrítica (9.8)—

KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" (supercheckout), a guest can upload files with extensions .php

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Knowband — Supercheckout

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-45384",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-45384",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-12T19:38:27.356198Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:knownband:supercheckout:*:*:*:*:*:*:*:*"
          ],
          "vendor": "knownband",
          "product": "supercheckout",
          "versions": [
            {
              "status": "affected",
              "version": "5.07",
              "lessThan": "6.07",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-10-19T13:15:10.387",
  "references": [
    {
      "url": "https://addons.prestashop.com/fr/processus-rapide-commande/18016-one-page-checkout-social-login-mailchimp.html",
      "tags": [
        "Product"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.friendsofpresta.org/modules/2023/10/17/supercheckout.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://addons.prestashop.com/fr/processus-rapide-commande/18016-one-page-checkout-social-login-mailchimp.html",
      "tags": [
        "Product"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.friendsofpresta.org/modules/2023/10/17/supercheckout.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "KnowBand supercheckout > 5.0.7 and < 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module \"Module One Page Checkout, Social Login & Mailchimp\" (supercheckout), a guest can upload files with extensions .php"
    },
    {
      "lang": "es",
      "value": "KnowBand supercheckout &gt; 5.0.7 y &lt; 6.0.7 es vulnerable a la carga sin restricciones de archivos con tipos peligrosos. En el módulo \"Module One Page Checkout, Social Login &amp; Mailchimp\" (supercheckout), un invitado puede cargar archivos con extensiones .php"
    }
  ],
  "lastModified": "2026-06-17T06:28:44.630",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:knowband:supercheckout:*:*:*:*:*:prestashop:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95F6F1F2-4D6C-46A2-8AC6-03DD6D49F30A",
              "versionEndExcluding": "6.0.7",
              "versionStartIncluding": "5.0.7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}