PT-2021-14407 · Unknown · Prestashop

Matkspublished · Published 2021-02-26 · Updated 2021-03-05 · CVE-2021-21308

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 1.7.2 PrestaShop versions prior to 1.7.7.2 are not needed as 1.7.7.2 is the fixed version, so we only need versions prior to 1.7.2.

Description: PrestaShop is a fully scalable open source e-commerce solution. The soft logout system in PrestaShop is not complete, allowing an attacker to execute foreign requests and customer commands.

Recommendations: For PrestaShop versions prior to 1.7.2, update to version 1.7.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the soft logout system until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2021-21308

GHSA-557H-HF3C-WHCG

Affected Products

Prestashop

References · 7

• https://github.com/PrestaShop/PrestaShop/commit/2f673bd93e313f08c35e74decc105f40dc0b7dee · Patch
• https://osv.dev/vulnerability/CVE-2021-21308 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21308 · Security Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-557h-hf3c-whcg · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/1.7.7.2 · Note
• https://t.me/cvenotify/10616 · Telegram Post
• https://t.me/cibsecurity/24245 · Telegram Post