PT-2020-14169 · Prestashop · Prestashop

Jomar + 1 · Published 2020-07-02 · Updated 2020-07-02 · CVE-2020-15081

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.5.0.0 through 1.7.6.5

Description The issue concerns information exposure in the upload directory. A possible workaround is to add an empty index.php file in the upload directory. The problem is fixed in version 1.7.6.6.

Recommendations For PrestaShop versions 1.5.0.0 through 1.7.6.5, update to version 1.7.6.6 to resolve the issue. As a temporary workaround, consider adding an empty index.php file in the upload directory until the update to version 1.7.6.6 is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-548

CWE-200

Related Identifiers

CVE-2020-15081

GHSA-997J-F42G-X57C

Affected Products

Prestashop

References · 5

• https://github.com/PrestaShop/PrestaShop/commit/bac9ea6936b073f84b1abd9864317af3713f1901 · Patch
• https://osv.dev/vulnerability/CVE-2020-15081 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15081 · Security Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-997j-f42g-x57c · Note
• https://t.me/cvenotify/4835 · Telegram Post