Improper access control in PrestaShop - CVE-2023-43664
Published: September 28, 2023 / Updated: May 4, 2026
Vulnerability identifier: #VU129569
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-43664
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper access control in the ajaxProcessGetPossibleHookingListForModule method when handling back office requests to list installed modules. A remote user can send a request to enumerate installed modules to disclose sensitive information.
The issue affects employees in the back office who do not have access rights for this action.
Affected software
PrestaShop
How to mitigate CVE-2023-43664
Install security update from vendor's website.
PrestaShop - update to 8.1.2