PT-2018-12183 · Prestashop · Prestashop

Charles Fol · Published 2018-07-09 · Updated 2019-10-03 · CVE-2018-13784

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.6.1.20 PrestaShop versions 1.7.x prior to 1.7.3.4

Description The issue concerns the mishandling of cookie encryption in certain PHP files, specifically Cookie.php, Rinjdael.php, and Blowfish.php.

Recommendations For PrestaShop versions prior to 1.6.1.20, update to version 1.6.1.20 or later. For PrestaShop versions 1.7.x prior to 1.7.3.4, update to version 1.7.3.4 or later.

Exploit

Fix

Related Identifiers

CVE-2018-13784

Affected Products

Prestashop

References · 9

• 🔥 https://github.com/ambionics/prestashop-exploits · Exploit
• 🔥 https://exploit-db.com/exploits/45047 · Exploit
• 🔥 https://exploit-db.com/exploits/45046 · Exploit
• http://build.prestashop.com/news/prestashop-1-7-3-4-1-6-1-20-maintenance-releases · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-13784 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13784 · Security Note
• https://github.com/PrestaShop/PrestaShop/pull/9222 · Note
• https://github.com/PrestaShop/PrestaShop/pull/9218 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13784 · Note