PT-2020-17863 · Prestashop · Prestashop

Komradz86 · Published 2020-07-02 · Updated 2023-01-27 · CVE-2020-4074

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.5.0.0 through 1.7.6.6 PrestaShop versions 1.5.0.0 through 1.7.7.6 is not used because 1.7.6.6 is the fixed version mentioned in the NVD source which has higher priority than Telegram.

Description The authentication system in PrestaShop is malformed, allowing an attacker to forge requests and execute admin commands.

Recommendations For PrestaShop versions 1.5.0.0 through 1.7.6.6, update to version 1.7.6.6 or later to resolve the issue. As a temporary workaround, consider restricting access to admin commands until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-4074

GHSA-CCVH-JH5X-MPG4

Affected Products

Prestashop

References · 6

• https://github.com/PrestaShop/PrestaShop/commit/30b6a7bdaca9cb940d3ce462906dbb062499fc30 · Patch
• https://osv.dev/vulnerability/CVE-2020-4074 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4074 · Security Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-ccvh-jh5x-mpg4 · Note
• https://t.me/avleonovcom/781 · Telegram Post
• https://t.me/cvenotify/4831 · Telegram Post