CVE-2024-36682

{"id": "CVE-2024-36682", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-06-24T22:15:10.377", "references": [{"url": "https://security.friendsofpresta.org/modules/2024/06/20/pk_themesettings.html", "source": "cve@mitre.org"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-359"}]}], "descriptions": [{"lang": "en", "value": "In the module \"Theme settings\" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while SHOP is in maintenance mode. Due to a lack of permissions control, a guest can access the txt file which collect email when maintenance is enable which can lead to leak of personal information."}, {"lang": "es", "value": "En el m\u00f3dulo \"Configuraci\u00f3n del tema\" (pk_themesettings) &lt;= 1.8.8 de Promokit.eu para PrestaShop, un invitado puede descargar todos los correos electr\u00f3nicos recopilados mientras SHOP est\u00e1 en modo de mantenimiento. Debido a la falta de control de permisos, un invitado puede acceder al archivo de texto que recopila el correo electr\u00f3nico cuando el mantenimiento est\u00e1 habilitado, lo que puede provocar una filtraci\u00f3n de informaci\u00f3n personal."}], "lastModified": "2024-08-01T13:53:12.263", "sourceIdentifier": "cve@mitre.org"}