GHSA-gvrg-62jp-rf7j
PrestaShop allows employee without any access rights to list all installed modules
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | prestashop/prestashop | < 8.1.2 | 8.1.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
In BO, an employee can list all modules without any access rights: method `ajaxProcessGetPossibleHookingListForModule` doesn't check access rights
### Patches
Fixed on 8.1.2
### Workarounds
### References
References
External links from the advisory. They lead to third-party sites.