PT-2025-36611 · Packagist · Prestashop/Prestashop

Publicado 2025-09-04 · Atualizado 2025-09-04

OSV

CVSS v3.1

4.2

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Impact

An unauthenticated attacker with access to the back-office URL can manipulate the id employee and reset token parameters to enumerate valid back-office employee email addresses.

Impacted parties: Store administrators and employees: their email addresses are exposed. Merchants: risk of phishing, social engineering, and brute-force attacks targeting admin accounts.

Patches

PrestaShop 8.2.3

Workarounds

You must upgrade, or at least apply the changes from the PrestaShop 8.2.3 patch. More information: https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release/

Correção

Side Channel Attack

Enumeração de Fraquezas

CWE-203

CWE-359

Identificadores relacionados

GHSA-8XX5-H6M3-JR33

Produtos afetados

Prestashop/Prestashop

Referências · 10

• https://github.com/PrestaShop/PrestaShop · Nota
• https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.3 · Nota
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-8xx5-h6m3-jr33 · Nota
• https://github.com/PrestaShop/PrestaShop/commit/c97bdf10f77fedbe5a61a1dec5f96b3abb1d76fb · Nota
• https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.1 · Nota
• https://prestashop.com · Nota
• https://osv.dev/vulnerability/GHSA-8xx5-h6m3-jr33 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-51586 · Nota de Segurança
• https://maxime-morel.github.io/advisories/2025/CVE-2025-51586.md · Nota
• https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release · Nota