PT-2020-18369 · Prestashop · Prestashop
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
PrestaShop versions 1.5.0.0 through 1.7.6.4
Description
The issue is related to improper access control in PrestaShop, specifically affecting legacy controllers since version 1.5.0.0. The affected API endpoints include "admin-dev/index.php/configure/shop/customer-preferences/", "admin-dev/index.php/improve/international/translations/", "admin-dev/index.php/improve/international/geolocation/", "admin-dev/index.php/improve/international/localization", "admin-dev/index.php/configure/advanced/performance", "admin-dev/index.php/sell/orders/delivery-slips/", and "admin-dev/index.php?controller=AdminStatuses".
Recommendations
For PrestaShop versions 1.5.0.0 through 1.7.6.4, update to version 1.7.6.5 to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints until the update can be applied.
Fix
DoS
Incorrect Authorization
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Prestashop