Blockwishlist
Monthly
Authenticated customers on PrestaShop storefronts running the blockwishlist module through 3.0.2 can retrieve share tokens for arbitrary wishlists due to a missing ownership check in the getUrlByIdWishListAction method, exposing other customers' private wishlist contents. The flaw is an IDOR (CWE-639) exploitable by supplying sequential numeric wishlist identifiers; it does not allow modification of data or account takeover, and our independent assessment rates it a genuine but low-severity authorization weakness. Publicly available exploit code exists, but active exploitation has not been confirmed.
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Authenticated customers on PrestaShop storefronts running the blockwishlist module through 3.0.2 can retrieve share tokens for arbitrary wishlists due to a missing ownership check in the getUrlByIdWishListAction method, exposing other customers' private wishlist contents. The flaw is an IDOR (CWE-639) exploitable by supplying sequential numeric wishlist identifiers; it does not allow modification of data or account takeover, and our independent assessment rates it a genuine but low-severity authorization weakness. Publicly available exploit code exists, but active exploitation has not been confirmed.
prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.