PT-2025-36483 · Unknown · Prestashop

Maxime Morel · Published 2025-09-04 · Updated 2025-12-01 · CVE-2025-51586

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 8.2.1 PrestaShop version 8.2.2 PrestaShop version 8.2.3

Description: An issue exists in the controllers/admin/AdminLoginController.php file that allows attackers to gain sensitive information via the password reset feature. This allows for the enumeration of Back Office accounts remotely without requiring login credentials.

Recommendations: Upgrade to version 8.2.3. Upgrade to version 8.2.1 or later.

Fix

Side Channel Attack

Weakness Enumeration

CWE-203

CWE-359

Related Identifiers

BIT-PRESTASHOP-2025-51586

CVE-2025-51586

GHSA-8XX5-H6M3-JR33

Affected Products

Prestashop

References · 21

• https://osv.dev/vulnerability/BIT-prestashop-2025-51586 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-51586 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8xx5-h6m3-jr33 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-51586 · Security Note
• https://github.com/PrestaShop/PrestaShop · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.3 · Note
• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-8xx5-h6m3-jr33 · Note
• https://github.com/PrestaShop/PrestaShop/commit/c97bdf10f77fedbe5a61a1dec5f96b3abb1d76fb · Note
• https://github.com/PrestaShop/PrestaShop/releases/tag/8.2.1 · Note
• https://t.me/CVEtracker/31971 · Telegram Post
• https://twitter.com/CVEnew/status/1965094573736428018 · Twitter Post
• https://prestashop.com · Note
• https://t.me/cveNotify/134671 · Telegram Post
• https://t.me/cveNotify/134808 · Telegram Post
• https://t.me/cveNotify/135354 · Telegram Post