PT-2020-14168 · Prestashop · Prestashop

Komradz + 1 · Published 2020-07-02 · Updated 2021-11-18 · CVE-2020-15080

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.7.4.0 through 1.7.6.5

Description The issue arises from some files being incorrectly included in the release archive or being accessible when they should not be. A possible workaround is to restrict access to certain files, specifically making sure composer.json and docker-compose.yml are not accessible on the server.

Recommendations For PrestaShop versions 1.7.4.0 through 1.7.6.5, update to version 1.7.6.6 to resolve the issue. As a temporary workaround, consider restricting access to composer.json and docker-compose.yml files on the server until the update to version 1.7.6.6 can be applied.

Fix

Missing Authorization

Information Disclosure

Weakness Enumeration

CWE-862

CWE-200

Related Identifiers

CVE-2020-15080

GHSA-492W-2PP5-XHVG

Affected Products

Prestashop

References · 5

• https://github.com/PrestaShop/PrestaShop/commit/35ef7e9d892287c302df1fc5aa05ecfc6f15bc76 · Patch
• https://osv.dev/vulnerability/CVE-2020-15080 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15080 · Security Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-492w-2pp5-xhvg · Note
• https://t.me/cvenotify/4834 · Telegram Post