CVE-2023-47109

PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a block in blockreassurance module, a BO user can modify the http request and give the path of any file in the project instead of an image. When deleting the block from the BO, the file will be deleted. It is possible to make the website completely unavailable by removing index.php for example. This issue has been patched in version 5.1.4.

• CWE-285

• https://github.com/PrestaShop/blockreassurance/commit/2d0e97bebf795690caffe33c1ab23a9bf43fcdfaPatch
• https://github.com/PrestaShop/blockreassurance/commit/eec00da564db4c1804b0a0d1e3d9f7ec4e27d823Patch
• https://github.com/PrestaShop/blockreassurance/releases/tag/v5.1.4Release Notes
• https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-83j2-qhx2-p7jcVendor Advisory
• https://github.com/PrestaShop/blockreassurance/commit/2d0e97bebf795690caffe33c1ab23a9bf43fcdfaPatch
• https://github.com/PrestaShop/blockreassurance/commit/eec00da564db4c1804b0a0d1e3d9f7ec4e27d823Patch
• https://github.com/PrestaShop/blockreassurance/releases/tag/v5.1.4Release Notes
• https://github.com/PrestaShop/blockreassurance/security/advisories/GHSA-83j2-qhx2-p7jcVendor Advisory

Published

Nov 8, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-47102UrBackup Server 2.5.31 allows brute-force enumeration of use…5.3
• CVE-2023-47104tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows…9.8
• CVE-2023-47105exec.CommandContext in Chaosblade 0.3 through 1.7.3, when se…8.6
• CVE-2023-47106Traefik is an open source HTTP reverse proxy and load balanc…6.5
• CVE-2023-47107PILOS is an open source front-end for BigBlueButton servers …8.8
• CVE-2023-47108OpenTelemetry-Go Contrib is a collection of third-party pack…7.5
• CVE-2023-4711A vulnerability, which was classified as critical, has been …8.1
• CVE-2023-47110blockreassurance adds an information block aimed at offering…5.3
• CVE-2023-47111ZITADEL provides identity infrastructure. ZITADEL provides a…3.7
• CVE-2023-47112Rundeck is an open source automation service with a web cons…4.3
• CVE-2023-47113BleachBit cleans files to free disk space and to maintain pr…7.3
• CVE-2023-47114Fides is an open-source privacy engineering platform for man…6.1