Vulnerability · Published Mar 5, 2020 · Assigned by GitHub_M

CVE-2020-5250Possible information disclosure in PrestaShop

High 7.6

In plain English

A high-severity security flaw in PrestaShop from PrestaShop. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 58% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)0.9%top 41.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

In PrestaShop before version 1.7.6.4, when a customer edits their address, they can freely change the id_address in the form, and thus steal someone else's address. It is the same with CustomerForm, you are able to change the id_customer and change all information of all accounts. The problem is patched in version 1.7.6.4.

Affected products (as reported)

Vendor	Product	Versions
PrestaShop	PrestaShop	< 1.7.6.4

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

References

https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-mhfc-6rhg-fxp3 x_refsource_CONFIRM
https://github.com/PrestaShop/PrestaShop/commit/a4a609b5064661f0b47ab5bc538e1a9cd3dd1069 x_refsource_MISC