PT-2020-18369
CVE-2020-5279
·
تاريخ النشر
2020-04-20
·
تاريخ التحديث
2020-04-29
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
PrestaShop versions 1.5.0.0 through 1.7.6.4
Description
The issue is related to improper access control in PrestaShop, specifically affecting legacy controllers since version 1.5.0.0. The affected API endpoints include "admin-dev/index.php/configure/shop/customer-preferences/", "admin-dev/index.php/improve/international/translations/", "admin-dev/index.php/improve/international/geolocation/", "admin-dev/index.php/improve/international/localization", "admin-dev/index.php/configure/advanced/performance", "admin-dev/index.php/sell/orders/delivery-slips/", and "admin-dev/index.php?controller=AdminStatuses".
Recommendations
For PrestaShop versions 1.5.0.0 through 1.7.6.4, update to version 1.7.6.5 to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints until the update can be applied.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾