PT-2020-18369
CVE-2020-5279
·
Published
2020-04-20
·
Updated
2020-04-29
Description by
CVSS 3.1
6.5
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions
PrestaShop versions 1.5.0.0 through 1.7.6.4
Description
The issue is related to improper access control in PrestaShop, specifically affecting legacy controllers since version 1.5.0.0. The affected API endpoints include "admin-dev/index.php/configure/shop/customer-preferences/", "admin-dev/index.php/improve/international/translations/", "admin-dev/index.php/improve/international/geolocation/", "admin-dev/index.php/improve/international/localization", "admin-dev/index.php/configure/advanced/performance", "admin-dev/index.php/sell/orders/delivery-slips/", and "admin-dev/index.php?controller=AdminStatuses".
Recommendations
For PrestaShop versions 1.5.0.0 through 1.7.6.4, update to version 1.7.6.5 to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints until the update can be applied.
Found an issue in the description? Have something to add? Feel free to write us 👾