PT-2020-14170 · Prestashop · Prestashop

Matkspublished · Published 2020-07-02 · Updated 2020-07-02 · CVE-2020-15082

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.6.0.1 through 1.7.6.5

Description The issue allows rewriting all configuration variables through the dashboard. The problem is fixed in version 1.7.6.6.

Recommendations For PrestaShop versions 1.6.0.1 through 1.7.6.5, update to version 1.7.6.6 to resolve the issue.

Fix

Related Identifiers

CVE-2020-15082

GHSA-MC98-XJM3-C4FM

Affected Products

Prestashop

References · 5

• https://github.com/PrestaShop/PrestaShop/commit/0f0d6238169a79d94f5ef28d24e60a9be8902f4b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15082 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15082 · Vendor Advisory
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mc98-xjm3-c4fm · Note
• https://t.me/cvenotify/4836 · Telegram Post