« Volver al listado

CVE-2024-36682

Estado: AplazadaAlta (7.5)—

In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email when maintenance is enable which can lead to leak of personal information.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Prestashop — PrestashopAIPromokit — PK ThemesettingsAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-36682",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-36682",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-15T14:27:22.581599Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:prestashopmodules:themesettings:*:*:*:*:*:*:*:*"
          ],
          "vendor": "prestashopmodules",
          "product": "themesettings",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.8.8"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-06-24T22:15:10.377",
  "references": [
    {
      "url": "https://security.friendsofpresta.org/modules/2024/06/20/pk_themesettings.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.friendsofpresta.org/modules/2024/06/20/pk_themesettings.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-359"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the module \"Theme settings\" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email when maintenance is enable which can lead to leak of personal information."
    },
    {
      "lang": "es",
      "value": "En el módulo \"Configuración del tema\" (pk_themesettings) &lt;= 1.8.8 de Promokit.eu para PrestaShop, un invitado puede descargar todos los correos electrónicos recopilados mientras SHOP está en modo de mantenimiento. Debido a la falta de control de permisos, un invitado puede acceder al archivo de texto que recopila el correo electrónico cuando el mantenimiento está habilitado, lo que puede provocar una filtración de información personal."
    }
  ],
  "lastModified": "2026-06-17T07:37:06.520",
  "sourceIdentifier": "cve@mitre.org"
}