Description
PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. In versions prior to 4.4.1 and 5.0.5, the backoffice is missing validation on input resulting in a directory traversal and arbitrary file disclosure. The vulnerability is fixed in versions 4.4.1 and 5.0.5. No known workarounds exist.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PrestaShopCorp | ps_checkout | < 4.4.1, >= 5.0.0, < 5.0.5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | prestashop/ps_checkout | < 4.4.1 | 4.4.1 | GHSA-fpxp-pfqm-x54w |
| Packagist | prestashop/ps_checkout | >= 5.0.0, < 5.0.5 | 5.0.5 | GHSA-fpxp-pfqm-x54w |