High 7.5 CVSS 3.1 supernewsletter Published on 2024-03-03

An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate…

CVECVE-2024-25839 GHSANo GHSA advisory

View at the source View JSON Last modified at the source: 2026-06-17

Description

An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate privileges and obtain sensitive information.

Original text by NVD (NIST), public domain.

CVSS metrics 3.1

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · secondary

High 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vectorNetwork

ComplexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

References

Patchgithub.com
https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-supernewsletter.md
Third Party Advisorysecurity.friendsofpresta.org
https://security.friendsofpresta.org/modules/2024/02/29/supernewsletter.html

Found a vulnerability?

Write to the PrestaShop core security team:

security-core@prestashop.com

Related advisories

Same module: supernewsletter

All supernewsletter advisories (2)

IDAdvisoryComponentSeverityAffected versionsPublishedFix

CVE-2024-33275 SQL injection vulnerability in Webbax supernewsletter v.1.4.21 and before allows a remote attacker to escalate… supernewsletter Critical 9.8 ≤ 1.4.21 2024-04-30 No

Do you use the supernewsletter module?

PrestaShield checks it from the outside, without FTP access, and alerts you of every new advisory that affects you.

Check if my shop is affected