Vulnerability · Published Jul 2, 2020 · Assigned by GitHub_M
CVE-2020-15081Information exposure in the upload directory in PrestaShop
Medium 5.3
In plain English
A medium-severity security flaw in PrestaShop from PrestaShop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)1.6%top 23.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there is information exposure in the upload directory. The problem is fixed in version 1.7.6.6. A possible workaround is to add an empty index.php file in the upload directory.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PrestaShop | PrestaShop | >= 1.5.0.0, < 1.7.6.6 |
Weakness: CWE-548 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N